File size: 3,282 Bytes
59ce7b1 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 |
# Security Policy
## Supported Versions
| Version | Supported |
| ------- | ------------------ |
| 0.1.x | :white_check_mark: |
## Reporting a Vulnerability
We take security seriously. If you discover a security vulnerability in DeepBoner, please report it responsibly.
### How to Report
1. **DO NOT** open a public GitHub issue for security vulnerabilities
2. Email security concerns to the repository maintainers via GitHub's private vulnerability reporting
3. Or use GitHub's Security Advisory feature: **Security** tab > **Report a vulnerability**
### What to Include
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
### Response Timeline
- **Acknowledgment**: Within 48 hours
- **Initial assessment**: Within 7 days
- **Fix timeline**: Depends on severity
- Critical: Within 48 hours
- High: Within 7 days
- Medium: Within 30 days
- Low: Next release cycle
## Security Measures
### API Key Handling
- API keys are loaded from environment variables only
- Keys are never logged or exposed in error messages
- `.env` files are gitignored
- No hardcoded credentials in source code
### Dependency Security
- Regular dependency audits via `pip-audit`
- Security scanning with `bandit` in CI
- Pinned dependencies for reproducibility
- Known CVE fixes:
- `mcp>=1.23.0` - Fixes GHSA-9h52-p55h-vw2f
- `langgraph-checkpoint-sqlite>=3.0.0` - Fixes GHSA-wwqv-p2pp-99h5
- `urllib3>=2.6.0` - Fixes GHSA-gm62-xv2j-4w53 and GHSA-2xpw-w6gg-jr37
### External API Security
- HTTPS enforced for all external API calls
- Rate limiting prevents abuse
- No sensitive data sent to external services (only search queries)
### Input Validation
- Pydantic models for strict input validation
- Query sanitization before external API calls
- Length limits on user inputs
## Security Best Practices for Users
### API Keys
1. Never commit `.env` files
2. Use environment variables in production
3. Rotate keys periodically
4. Use minimal permissions (read-only where possible)
### Deployment
1. Use the provided Docker image for consistency
2. Keep dependencies updated
3. Monitor for security advisories
4. Use HTTPS in production
### HuggingFace Spaces
1. Use Secrets (not public variables) for API keys
2. The HF_TOKEN is used server-side only
3. Users don't need their own tokens
## Known Security Considerations
### Third-Party APIs
DeepBoner queries external biomedical databases:
- PubMed (NCBI)
- ClinicalTrials.gov
- Europe PMC
- OpenAlex
These are trusted public APIs, but:
- Query content is visible to these services
- Rate limits apply
- Availability depends on upstream services
### LLM Providers
- OpenAI and HuggingFace process your queries
- Review their privacy policies if handling sensitive research
- Consider on-premise alternatives for sensitive use cases
### Local Data
- ChromaDB stores embeddings locally
- Default path: `./chroma_db/`
- Contains processed search results (not raw user data)
- Secure or delete when decommissioning
## Security Updates
Security updates will be released as patch versions (e.g., 0.1.1) and announced via:
- GitHub Security Advisories
- Release notes
---
*"Security is rock solid. We take evidence-based security very seriously."* 🔐
|