Flight: Security Overview

This overview describes Flight's current security practices and technical controls, together with security enhancements currently being implemented.

Vulnerability Intake and Exposure Analysis

Flight uses yarn audit to identify known vulnerabilities in third-party packages. This capability is being integrated into the build pipeline so that dependency-vulnerability scanning occurs automatically with each build rather than being performed on an ad hoc basis.

A software bill of materials (SBOM) is also being introduced for each release, providing a current snapshot of the software components and dependencies included in that release.

AI-assisted tools are currently used to support technical investigation, security investigation, and review. As automated vulnerability scanning is expanded, AI-assisted analysis may also be used to help assess and prioritize identified findings based on severity, exploitability, and potential impact.

Patch Prioritization

Identified vulnerabilities are assessed and prioritized according to severity, exploitability, and potential customer impact.

Flight is formalizing this process through defined target response times for each severity tier and designated responsibility for vulnerability triage and remediation.

AI-Informed Threat Modeling and Security Review

Security-sensitive code changes, including changes affecting authentication, permissions, and movement of funds, currently undergo AI-assisted review as part of the development process.

This practice is being formalized within a written code-review standard so that security review becomes a defined requirement for security-sensitive changes.

Protection Against Exploitation

Production infrastructure is protected by AWS Shield Standard, which provides baseline distributed denial-of-service (DDoS) protection within the AWS environment.

Administrative access is additionally protected through automatic IP blocking in response to repeated unauthorized access attempts.

Amazon CloudFront and AWS Web Application Firewall (WAF) are being introduced in front of the production application. AWS WAF managed rule sets will provide an additional application-layer control against common attack patterns and known malicious traffic. These controls will be staged and tested before production deployment.

Per-client application rate limiting is also enforced, providing independent request limits rather than a shared allowance across users.

Access Control and Audit

Role-based access control (RBAC) is a core component of the Flight platform. Each request is evaluated against the user's assigned role and permissions before access is permitted; authorization is not dependent solely on what is displayed through the user interface.

Actions across financially and operationally significant areas — including contributions, grants, balance adjustments, investments, fund and role management, onboarding, and payment processing — are recorded through an audit trail associated with the relevant actor, fund, and change.

Multi-factor authentication for staff and administrative accounts is being implemented.

Traffic to Flight's public applications is encrypted in transit using TLS/HTTPS.

Monitoring and Anomaly Detection

Flight uses New Relic for application performance monitoring and AWS CloudWatch for infrastructure monitoring.

This monitoring capability is being expanded through AWS GuardDuty for automated threat detection and Amazon Inspector for vulnerability and software-inventory scanning. Security-specific alert conditions are also being defined for patterns including unusual request-rate spikes, error-rate increases, and failed-login activity.

Continuous Asset Discovery

Flight's production infrastructure is intentionally controlled and relatively fixed rather than dynamically auto-scaling, reducing the number of infrastructure assets in motion at any given time.

Amazon Inspector will provide ongoing scanning of the running environment, while the per-release SBOM will provide a documented snapshot of software components and dependencies associated with each release. Together, these controls will provide more systematic and current visibility into Flight's technology assets and dependencies.

Automated Recovery

Flight's database operates on AWS RDS with automated backups, 14-day retention, and point-in-time recovery. This allows database restoration to a specific point within the available recovery window rather than relying solely on daily snapshots.

Application recovery can be performed by redeploying a known-good prior version through the deployment pipeline using a documented procedure that has been exercised in practice.

A faster scripted rollback capability is also planned to further streamline application recovery.

Incident Response and Resilience Testing

Flight's incident-response capability has been exercised through a real production availability incident, including investigation from initial report through root-cause identification, remediation, and verification.

The issue identified through that incident was corrected and the relevant application-layer control strengthened.

The incident-response process has since been formalized in a written plan defining what constitutes a security incident, escalation responsibilities, technical investigation and containment, incident documentation, recovery, and post-incident review.

A formal tabletop exercise against a hypothetical security scenario is planned as the next step in testing the documented process and identifying opportunities for further improvement.

Proactive Technology Lifecycle Management

Flight's approach is to upgrade, replace, or retire technology components that can no longer be appropriately maintained or secured.

Risk Assessment

Security risks are assessed according to severity, exploitability, and potential customer impact. Remediation is prioritized based on those factors rather than treating all identified issues uniformly.

Collaborative Threat Sharing

Flight does not currently participate in a formal cross-industry threat-sharing consortium. Where appropriate, Flight supports direct collaboration with customers and partners to exchange relevant security and threat information.

Disclosure and Transparency

If a security incident materially affects a customer or the services being provided, Flight recognizes the importance of timely notification.

Specific notification thresholds, responsibilities, and timeframes can be established within the applicable contractual and service-level framework.

Continuous Improvement

Flight treats security as an ongoing program. Security practices and controls are reviewed and adjusted as the platform, technology environment, threat landscape, and enterprise requirements evolve.