aws-xfa 1.0.0__tar.gz

aws_xfa-1.0.0/.gitignore

@@ -0,0 +1,28 @@
+*.py[cod]
+*.bak
+*.sw[po]
+
+.Python
+env/
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+*.egg-info/
+.installed.cfg
+*.egg
+.idea
+.vscode
+.venv
+.omc
+.claude
+.serena
+AGENTS.md
+CLAUDE.md

aws_xfa-1.0.0/CONTRIBUTING.md

@@ -0,0 +1,56 @@
+# Contributing to aws-xfa
+
+## License
+
+By contributing to this project, you agree that your contributions will be
+licensed under the [BSD Zero Clause License (0BSD)](LICENSE).
+
+## Developer Certificate of Origin (DCO)
+
+All contributions must be signed off under the [Developer Certificate of
+Origin](DCO) (DCO 1.1). This certifies that you have the right to submit
+the contribution under the project's open source license.
+
+### How to sign off
+
+Add a `Signed-off-by` line to every commit message:
+
+```
+Signed-off-by: Your Name <your.email@example.com>
+```
+
+The easiest way is to use the `-s` flag when committing:
+
+```bash
+git commit -s -m "your commit message"
+```
+
+### Fixing unsigned commits
+
+If you forgot to sign off, amend the most recent commit:
+
+```bash
+git commit --amend -s --no-edit
+```
+
+For multiple commits, use interactive rebase:
+
+```bash
+git rebase -i HEAD~N  # N = number of commits to fix
+# Change 'pick' to 'edit' for each commit, then:
+git commit --amend -s --no-edit
+git rebase --continue
+```
+
+## Pull Request Requirements
+
+1. All commits must be signed off (DCO).
+2. All source files must include `# SPDX-License-Identifier: 0BSD` as the
+   first comment line.
+3. Do not introduce dependencies with copyleft licenses (GPL, AGPL, etc.)
+   without discussion.
+
+## Security Vulnerabilities
+
+Do **not** open a public issue for security vulnerabilities. See
+[SECURITY.md](SECURITY.md) for reporting instructions.

aws_xfa-1.0.0/DCO

@@ -0,0 +1,34 @@
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.

aws_xfa-1.0.0/DISCLAIMER.md

@@ -0,0 +1,127 @@
+# Disclaimer
+
+## General Disclaimer
+
+THIS SOFTWARE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR IMPLIED
+WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT,
+AND FREEDOM FROM DEFECTS OR ERRORS.
+
+USE OF THIS SOFTWARE IS ENTIRELY AT YOUR OWN RISK. THE AUTHOR(S) SHALL NOT
+BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; UNAUTHORIZED
+ACCESS TO OR ALTERATION OF YOUR CREDENTIALS; BUSINESS INTERRUPTION; OR
+SECURITY BREACH) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+
+## Security Disclaimer
+
+This software handles sensitive security credentials including, but not
+limited to, AWS access keys, secret keys, session tokens, and MFA/TOTP
+codes. **No guarantees of any kind are made regarding the security,
+integrity, confidentiality, or safe handling of these credentials.**
+
+Specifically, the author(s) make no representations or warranties that:
+
+- Credentials are stored, transmitted, or handled securely
+- The software is free from vulnerabilities, bugs, or defects
+- The software will prevent unauthorized access to your AWS accounts
+- The software meets any specific security standard, certification, or
+  compliance requirement
+- The software is suitable for production, regulated, or high-security
+  environments
+
+**You are solely responsible for:**
+
+- Evaluating whether this software is appropriate for your use case
+- Securing your own systems, credentials, and AWS accounts
+- Complying with your organization's security policies
+- Any and all consequences of using this software
+
+This software has NOT been independently audited. It is NOT certified under
+SOC2, ISO 27001, FedRAMP, or any other security framework. Do not assume
+fitness for any particular security purpose.
+
+## Third-Party Services Disclaimer
+
+This software interacts with third-party services including, but not limited
+to:
+
+- **Amazon Web Services (AWS)** — including IAM, STS, and related APIs
+- **1Password CLI** — including credential retrieval and TOTP generation
+
+The author(s) are not affiliated with, endorsed by, or sponsored by Amazon
+Web Services, 1Password (AgileBits Inc.), or any other third-party service
+provider. All product names, trademarks, and registered trademarks are
+property of their respective owners.
+
+The author(s) are not responsible for:
+
+- Changes to third-party APIs that may break this software
+- Third-party service outages, data loss, or security incidents
+- Your compliance with third-party terms of service
+- Any fees, charges, or costs incurred through third-party service usage
+
+## Patent Notice
+
+This software is released under the BSD Zero Clause License (0BSD), which
+does not include an explicit patent grant or patent disclaimer. The author(s)
+are not aware of any patent claims covering this software and do not
+intentionally withhold any patent rights. However, NO EXPRESS OR IMPLIED
+PATENT LICENSE IS GRANTED by this software's license.
+
+## Data and Privacy Notice
+
+This software operates entirely on your local machine. It does not collect,
+transmit, phone home, or share any data with the author(s) or any third
+party. All credentials and configuration remain under your control on your
+local filesystem.
+
+However, the author(s) make no guarantees regarding:
+
+- How third-party services (AWS, 1Password) handle your data
+- Whether your credentials may be logged by your system, shell history,
+  or other local software
+- Compliance with GDPR, CCPA, HIPAA, or any other data protection regulation
+
+You are solely responsible for your own data protection compliance.
+
+## Export Control Notice
+
+This software may use or interact with cryptographic functionality provided
+by underlying system libraries (e.g., Python's ssl module, OpenSSL) and
+cloud service APIs. It does not itself implement cryptographic algorithms.
+
+The country in which you reside may have restrictions on the import,
+possession, use, and/or re-export of encryption software. BEFORE using this
+software, please check your country's laws, regulations, and policies
+concerning the import, possession, or use of encryption software to determine
+if this is permitted. See https://www.wassenaar.org/ for more information.
+
+The author(s) are not responsible for your compliance with export control
+regulations.
+
+## Limitation of Liability by Jurisdiction
+
+Some jurisdictions do not allow the exclusion or limitation of implied
+warranties or liability for incidental or consequential damages. In such
+jurisdictions, the liability of the author(s) shall be limited to the
+maximum extent permitted by applicable law.
+
+Nothing in this disclaimer shall be construed to limit any rights you may
+have under mandatory consumer protection legislation in your jurisdiction.
+
+## No Professional Advice
+
+Nothing in this software, its documentation, or its associated materials
+constitutes legal, security, financial, or professional advice. Consult a
+qualified professional for guidance specific to your situation.
+
+## Acceptance
+
+By using this software, you acknowledge that you have read this disclaimer,
+understand it, and agree to be bound by its terms. If you do not agree, do
+not use this software.

aws_xfa-1.0.0/LICENSE

@@ -0,0 +1,12 @@
+BSD Zero Clause License
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

aws_xfa-1.0.0/PKG-INFO

@@ -0,0 +1,185 @@
+Metadata-Version: 2.4
+Name: aws-xfa
+Version: 1.0.0
+Summary: AWS MFA credential helper — exchange long-term credentials for temporary STS tokens
+Project-URL: Homepage, https://github.com/karmazin-me/aws-xfa
+Project-URL: Repository, https://github.com/karmazin-me/aws-xfa
+Project-URL: Issues, https://github.com/karmazin-me/aws-xfa/issues
+Author-email: Eugene Karmazin <awsxfa@icloud.com>
+License: 0BSD
+License-File: LICENSE
+Keywords: 1password,aws,cli,credentials,mfa,sts
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: Zero-Clause BSD (0BSD)
+Classifier: Operating System :: MacOS :: MacOS X
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.9
+Requires-Dist: boto3
+Description-Content-Type: text/markdown
+
+<p align="center">
+  <img src="assets/banner.svg" alt="aws-xfa" />
+</p>
+
+# aws-xfa
+
+Exchange long-term AWS credentials for temporary STS tokens — handles MFA automatically, integrates with 1Password, and can run as a background daemon that keeps credentials fresh without any manual steps.
+
+## Install
+
+```sh
+pip install aws-xfa
+```
+
+## First run
+
+If you don't have `~/.aws/credentials` yet, just run:
+
+```sh
+aws-xfa
+```
+
+It will prompt you for everything:
+
+```
+AWS Access Key ID: AKIA...
+AWS Secret Access Key: ************
+MFA device ARN (e.g. arn:aws:iam::123456789012:mfa/username): arn:aws:iam::...
+AWS region (e.g. us-east-1): us-east-1
+Use 1Password CLI to automatically fetch MFA codes? [y/N]:
+```
+
+Then it calls AWS STS and writes your temporary credentials to `~/.aws/credentials`.
+
+## Existing credentials file
+
+If you already have `~/.aws/credentials` with a `[default]` section, aws-xfa will migrate it automatically — creating `[default-long-term]` for your permanent keys, and using `[default]` for the temporary STS credentials.
+
+Your credentials file structure after setup:
+
+```ini
+[default-long-term]
+aws_access_key_id     = AKIA...          # your permanent keys — never exposed to AWS CLI
+aws_secret_access_key = ...
+aws_mfa_device        = arn:aws:iam::123456789012:mfa/username
+
+[default]
+aws_access_key_id     = ASIA...          # temporary — written by aws-xfa after each STS call
+aws_secret_access_key = ...
+aws_session_token     = ...
+aws_security_token    = ...
+expiration            = 2026-03-04 22:00:00
+```
+
+## Daily usage
+
+```sh
+aws-xfa
+# Enter AWS MFA code for device [...]: 123456
+# Success! Your credentials will expire in 12h 0m 0s at: 2026-03-05 10:00:00 UTC
+```
+
+Running again while credentials are still valid does nothing:
+
+```sh
+aws-xfa
+# Your credentials are still valid for 11h 55m 34s, they will expire at ...
+```
+
+For a named profile (`[work-long-term]` → `[work]`):
+
+```sh
+aws-xfa work
+```
+
+Force refresh before expiry:
+
+```sh
+aws-xfa --force
+aws-xfa work --force
+```
+
+## 1Password integration
+
+Skip manual OTP entry entirely. If you answered `y` during setup, you're already configured. To enable it later:
+
+```sh
+aws-xfa --1pass
+# Enter 1Password item name for profile 'default': AWS MFA
+```
+
+The item name is saved to `~/.config/aws-xfa/config.json`. **From then on, aws-xfa fetches the OTP automatically on every run** — no `--1pass` flag needed.
+
+```sh
+aws-xfa           # OTP fetched from 1Password silently
+aws-xfa work      # same for named profile
+```
+
+Requires the [`op` CLI](https://developer.1password.com/docs/cli/) to be installed and signed in. If `op` fails, aws-xfa falls back to prompting you manually.
+
+## Auto-refresh daemon
+
+Keep credentials fresh in the background — no manual intervention ever. The daemon wakes 5 minutes before expiry and renews automatically.
+
+**Requires 1Password** to be configured for the profile first (the daemon runs unattended).
+
+```sh
+aws-xfa daemon install default   # configure 1Password if needed, then install and start
+aws-xfa daemon status default    # show running status
+aws-xfa daemon stop default      # stop without removing config
+aws-xfa daemon delete default    # stop and remove all artifacts and logs
+```
+
+What gets installed per platform:
+
+| Platform | Persistence method |
+|----------|--------------------|
+| macOS    | LaunchAgent plist (`~/Library/LaunchAgents/com.user.aws-xfa-daemon-PROFILE.plist`) |
+| Linux    | systemd user unit (falls back to double-fork on systems without systemd) |
+| Windows  | detached process + `schtasks` on-logon scheduled task |
+
+Error logs: `~/.config/aws-xfa/errors-PROFILE.log`
+
+On Linux without systemd (Alpine, OpenRC, WSL), the daemon won't survive reboot automatically. The install command prints the command to add to your init scripts.
+
+## Options
+
+| Flag | Description |
+|------|-------------|
+| `--force` | Refresh even if credentials are still valid |
+| `--1pass` | Configure 1Password for this profile (one-time setup) |
+| `--duration SECONDS` | Session duration (default: 43200 = 12 h, min: 900, max: 129600) |
+| `--log-level debug` | Verbose output |
+
+Environment variables:
+
+| Variable | Effect |
+|----------|--------|
+| `MFA_STS_DURATION` | Session duration (same as `--duration`) |
+| `AWS_REGION` / `AWS_DEFAULT_REGION` | Region used for the STS endpoint |
+| `AWS_SHARED_CREDENTIALS_FILE` | Override the default `~/.aws/credentials` path |
+| `AWS_CONFIG_FILE` | Override the default `~/.aws/config` path |
+
+CLI flags take precedence over environment variables.
+
+## Before you use this tool
+
+Please read these before deploying aws-xfa in any environment:
+
+- [DISCLAIMER.md](DISCLAIMER.md) — no warranty; you are responsible for your AWS credentials and account security
+- [SECURITY.md](SECURITY.md) — how to report vulnerabilities
+- [LICENSE](LICENSE) — Zero-Clause BSD (0BSD)
+- [CONTRIBUTING.md](CONTRIBUTING.md) — how to contribute

aws_xfa-1.0.0/README.md

@@ -0,0 +1,153 @@
+<p align="center">
+  <img src="assets/banner.svg" alt="aws-xfa" />
+</p>
+
+# aws-xfa
+
+Exchange long-term AWS credentials for temporary STS tokens — handles MFA automatically, integrates with 1Password, and can run as a background daemon that keeps credentials fresh without any manual steps.
+
+## Install
+
+```sh
+pip install aws-xfa
+```
+
+## First run
+
+If you don't have `~/.aws/credentials` yet, just run:
+
+```sh
+aws-xfa
+```
+
+It will prompt you for everything:
+
+```
+AWS Access Key ID: AKIA...
+AWS Secret Access Key: ************
+MFA device ARN (e.g. arn:aws:iam::123456789012:mfa/username): arn:aws:iam::...
+AWS region (e.g. us-east-1): us-east-1
+Use 1Password CLI to automatically fetch MFA codes? [y/N]:
+```
+
+Then it calls AWS STS and writes your temporary credentials to `~/.aws/credentials`.
+
+## Existing credentials file
+
+If you already have `~/.aws/credentials` with a `[default]` section, aws-xfa will migrate it automatically — creating `[default-long-term]` for your permanent keys, and using `[default]` for the temporary STS credentials.
+
+Your credentials file structure after setup:
+
+```ini
+[default-long-term]
+aws_access_key_id     = AKIA...          # your permanent keys — never exposed to AWS CLI
+aws_secret_access_key = ...
+aws_mfa_device        = arn:aws:iam::123456789012:mfa/username
+
+[default]
+aws_access_key_id     = ASIA...          # temporary — written by aws-xfa after each STS call
+aws_secret_access_key = ...
+aws_session_token     = ...
+aws_security_token    = ...
+expiration            = 2026-03-04 22:00:00
+```
+
+## Daily usage
+
+```sh
+aws-xfa
+# Enter AWS MFA code for device [...]: 123456
+# Success! Your credentials will expire in 12h 0m 0s at: 2026-03-05 10:00:00 UTC
+```
+
+Running again while credentials are still valid does nothing:
+
+```sh
+aws-xfa
+# Your credentials are still valid for 11h 55m 34s, they will expire at ...
+```
+
+For a named profile (`[work-long-term]` → `[work]`):
+
+```sh
+aws-xfa work
+```
+
+Force refresh before expiry:
+
+```sh
+aws-xfa --force
+aws-xfa work --force
+```
+
+## 1Password integration
+
+Skip manual OTP entry entirely. If you answered `y` during setup, you're already configured. To enable it later:
+
+```sh
+aws-xfa --1pass
+# Enter 1Password item name for profile 'default': AWS MFA
+```
+
+The item name is saved to `~/.config/aws-xfa/config.json`. **From then on, aws-xfa fetches the OTP automatically on every run** — no `--1pass` flag needed.
+
+```sh
+aws-xfa           # OTP fetched from 1Password silently
+aws-xfa work      # same for named profile
+```
+
+Requires the [`op` CLI](https://developer.1password.com/docs/cli/) to be installed and signed in. If `op` fails, aws-xfa falls back to prompting you manually.
+
+## Auto-refresh daemon
+
+Keep credentials fresh in the background — no manual intervention ever. The daemon wakes 5 minutes before expiry and renews automatically.
+
+**Requires 1Password** to be configured for the profile first (the daemon runs unattended).
+
+```sh
+aws-xfa daemon install default   # configure 1Password if needed, then install and start
+aws-xfa daemon status default    # show running status
+aws-xfa daemon stop default      # stop without removing config
+aws-xfa daemon delete default    # stop and remove all artifacts and logs
+```
+
+What gets installed per platform:
+
+| Platform | Persistence method |
+|----------|--------------------|
+| macOS    | LaunchAgent plist (`~/Library/LaunchAgents/com.user.aws-xfa-daemon-PROFILE.plist`) |
+| Linux    | systemd user unit (falls back to double-fork on systems without systemd) |
+| Windows  | detached process + `schtasks` on-logon scheduled task |
+
+Error logs: `~/.config/aws-xfa/errors-PROFILE.log`
+
+On Linux without systemd (Alpine, OpenRC, WSL), the daemon won't survive reboot automatically. The install command prints the command to add to your init scripts.
+
+## Options
+
+| Flag | Description |
+|------|-------------|
+| `--force` | Refresh even if credentials are still valid |
+| `--1pass` | Configure 1Password for this profile (one-time setup) |
+| `--duration SECONDS` | Session duration (default: 43200 = 12 h, min: 900, max: 129600) |
+| `--log-level debug` | Verbose output |
+
+Environment variables:
+
+| Variable | Effect |
+|----------|--------|
+| `MFA_STS_DURATION` | Session duration (same as `--duration`) |
+| `AWS_REGION` / `AWS_DEFAULT_REGION` | Region used for the STS endpoint |
+| `AWS_SHARED_CREDENTIALS_FILE` | Override the default `~/.aws/credentials` path |
+| `AWS_CONFIG_FILE` | Override the default `~/.aws/config` path |
+
+CLI flags take precedence over environment variables.
+
+## Before you use this tool
+
+Please read these before deploying aws-xfa in any environment:
+
+- [DISCLAIMER.md](DISCLAIMER.md) — no warranty; you are responsible for your AWS credentials and account security
+- [SECURITY.md](SECURITY.md) — how to report vulnerabilities
+- [LICENSE](LICENSE) — Zero-Clause BSD (0BSD)
+- [CONTRIBUTING.md](CONTRIBUTING.md) — how to contribute

aws_xfa-1.0.0/SECURITY.md

@@ -0,0 +1,97 @@
+# Security Policy
+
+## Important Notice
+
+THIS SOFTWARE IS PROVIDED "AS IS" WITH NO SECURITY GUARANTEES OF ANY KIND.
+See [DISCLAIMER.md](DISCLAIMER.md) and [LICENSE](LICENSE) for full terms.
+
+The author(s) provide this software on a best-effort, volunteer basis.
+**There is no obligation, express or implied, to fix any reported
+vulnerability, to respond within any timeframe, or to maintain this software
+at any security standard.**
+
+## Threat Model
+
+### What aws-xfa IS designed to do
+
+- Simplify the AWS MFA credential workflow for individual developers
+- Reduce manual `aws sts get-session-token` invocations
+- Optionally retrieve TOTP codes from 1Password CLI
+- Cache temporary session credentials locally in `~/.aws/credentials`
+
+### What aws-xfa is NOT designed to protect against
+
+- **Compromised local machine**: If an attacker has access to your local
+  filesystem, shell, or memory, this tool cannot protect your credentials.
+  This tool assumes no attackers on your local machine.
+- **Malicious dependencies**: Supply chain attacks on Python packages,
+  pip, or system libraries are outside the scope of this tool.
+- **AWS account misconfiguration**: This tool does not validate or enforce
+  IAM policies, permission boundaries, or account-level security settings.
+- **Credential leakage via shell history**: Commands and environment
+  variables may be logged by your shell. This tool does not scrub shell
+  history.
+- **Side-channel attacks**: Timing attacks, memory inspection, or other
+  side-channel vectors are not mitigated.
+- **Network-level attacks**: MITM, DNS hijacking, or TLS downgrade attacks
+  on connections to AWS or 1Password APIs are handled by underlying system
+  TLS libraries, not by this tool.
+
+### Credential storage
+
+- Long-term AWS credentials are stored in `~/.aws/credentials` in plaintext,
+  consistent with AWS CLI's own behavior.
+- Temporary session tokens are written to `~/.aws/credentials` in plaintext.
+- File permissions are set to user-only (0600) on supported systems, but
+  this is a best-effort measure, not a security guarantee.
+- **Credentials may persist in memory** during the lifetime of the process.
+- **Git history**: If your `~/.aws/` directory is accidentally committed to
+  a git repository, credentials will be visible in the git history even
+  after removal.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it responsibly:
+
+1. **DO NOT** open a public GitHub issue for security vulnerabilities.
+2. Send a description of the vulnerability to: **[INSERT EMAIL OR USE
+   GITHUB SECURITY ADVISORIES]**
+3. Include steps to reproduce, if possible.
+4. Allow reasonable time for assessment before public disclosure.
+
+### What to expect
+
+- Acknowledgment of receipt is provided on a best-effort basis.
+- **There is no guaranteed response time, fix timeline, or SLA.**
+- The author(s) may or may not issue a fix, at their sole discretion.
+- The author(s) may or may not issue a CVE or security advisory.
+- If you require guaranteed security response times, this software is
+  not suitable for your use case.
+
+## Supported Versions
+
+Only the latest released version receives any security attention.
+Previous versions are not supported, patched, or maintained.
+
+| Version | Status            |
+|---------|-------------------|
+| Latest  | Best-effort only  |
+| < Latest| Not supported     |
+
+## Dependencies
+
+This software depends on third-party packages. The author(s) are not
+responsible for vulnerabilities in dependencies. Users should:
+
+- Regularly update dependencies (`pip install --upgrade aws-xfa`)
+- Monitor advisories for boto3, botocore, and other dependencies
+- Use `pip audit` or similar tools to check for known vulnerabilities
+
+## Security Best Practices (Your Responsibility)
+
+- Rotate your AWS long-term credentials regularly
+- Use the shortest practical session duration
+- Enable CloudTrail logging on your AWS accounts
+- Do not run this tool as root
+- Do not store credentials in version-controlled directories
+- Review the source code yourself if your threat model requires it