# Security

Given that Narwhals can only work if people trust it, we recognise the importance of following
good security practices. Here are some practices we follow:

- We publish to PyPI via trusted publishing and are PEP740-compliant.
- We don't use `pull_request_target` in any CI job.
- The release CI job can only be triggered for tag pushes, and only
  Narwhals members with release permissions (see below) can push tags.
- All members of `narwhals-dev` are required to have two-factor authentication
  enabled.
- There are no binary or opaque files in the Narwhals repository.
- Release permissions are only given to people who satisfy all of the following:

    - Have met the original author in real life on multiple days.
    - Have made significant contributions to Narwhals.
    - Give off good vibes. This is hard to rigorously define, but it's there so we
        can refuse anyone who, despite satisfying the above two criteria, we don't
        feel like we can trust.
    - There are fewer than 5 active people with release permissions. That is
        to say, even if someone satisfies all of the above, if there are already 5
        people with release permissions, then we will not be adding any more (though
        you may still be added to `narwhals-dev` and get permission to merge pull
        requests which you believe are ready). Note that we already meet that limit.
