Development Security

Secure Software Development Life Cycle

Xano maintains a Secure Software Development Lifecycle (SSDLC) designed to integrate security, privacy, quality, and compliance considerations throughout the development and maintenance of Xano software. The SSDLC applies across planning, design, development, code review, testing, change management, release, deployment, and post-deployment monitoring activities.

Security is considered throughout each stage rather than treated as a final review step. Depending on the nature of a change, development activities include secure design practices, threat modeling, peer review, automated security checks, functional and security testing, release approval, and ongoing monitoring. Xano’s internal SSDLC also incorporates privacy-by-design principles and requirements for protecting personal and regulated information.

Planning & Design

During planning and design, Xano evaluates relevant product, security, privacy, quality, contractual, and regulatory requirements. Our development practices are designed to apply principles such as least privilege, secure defaults, separation of duties, data minimization, and appropriate protection of sensitive information. Relevant stakeholders may participate in reviewing proposed features, workflows, or significant system changes before implementation.

Development & Code Review

Xano maintains secure coding practices for software developed and maintained by our engineering team. Development work is managed through controlled versioning and change processes intended to support traceability, review, testing, and approval before release. Code changes are subject to human review and automated checks. Reviews consider factors such as intended functionality, secure coding practices, authorization and validation logic, performance, dependencies, and the potential introduction of vulnerabilities or sensitive information. Automated analysis and dependency checks supplement, but do not replace, qualified human review.

AI-Assisted Development

Xano uses approved AI systems to assist with certain development and testing activities, which may include generating or refining code, tests, documentation, and other engineering materials. AI-generated outputs are treated as suggestions rather than independently trusted development artifacts. AI systems do not replace engineering accountability, secure coding requirements, testing, peer review, or release approval. Qualified personnel remain responsible for reviewing AI-assisted outputs for security, accuracy, suitability, privacy, and compliance before changes are deployed.

Testing & Quality Assurance

Xano uses multiple forms of testing to evaluate software changes before release. Depending on the change, this may include unit, functional, integration, end-to-end, regression, cross-browser, and application security testing. Changes are evaluated against applicable functional, quality, and security requirements before being approved for release.

Development and testing activities are designed to avoid the unnecessary use of customer or production data. Xano generally uses synthetic, anonymized, mocked, or otherwise non-production data for testing.

Release Visibility

Published updates and release information can be reviewed through the What’s New page in Xano Docs. The timing and level of control available for platform updates may vary by plan. Some plans allow customers to select preferred release timing or maintenance windows. Emergency or security-related updates may be handled differently where necessary to protect the platform and its users.

Product Feedback & Suggestions

We welcome feedback and suggestions as part of our ongoing product development process. Users may submit ideas, provide feedback, discuss potential improvements, and participate in feature requests through our Developer Hub.

These submissions may help inform future product planning, but neither submission nor community support guarantees that a requested feature will be developed, prioritized, or released.