SECURITY.md

Security Policy

Supported Versions

Version	Supported
0.1.x	:white_check_mark:

Reporting a Vulnerability

We take security seriously. If you discover a security vulnerability in DeepBoner, please report it responsibly.

How to Report

1. DO NOT open a public GitHub issue for security vulnerabilities
2. Email security concerns to the repository maintainers via GitHub's private vulnerability reporting
3. Or use GitHub's Security Advisory feature: Security tab > Report a vulnerability

What to Include

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

Response Timeline

• Acknowledgment: Within 48 hours
• Initial assessment: Within 7 days
• Fix timeline: Depends on severity
  • Critical: Within 48 hours
  • High: Within 7 days
  • Medium: Within 30 days
  • Low: Next release cycle

Security Measures

API Key Handling

• API keys are loaded from environment variables only
• Keys are never logged or exposed in error messages
• .env files are gitignored
• No hardcoded credentials in source code

Dependency Security

• Regular dependency audits via pip-audit
• Security scanning with bandit in CI
• Pinned dependencies for reproducibility
• Known CVE fixes:
  • mcp>=1.23.0 - Fixes GHSA-9h52-p55h-vw2f
  • langgraph-checkpoint-sqlite>=3.0.0 - Fixes GHSA-wwqv-p2pp-99h5
  • urllib3>=2.6.0 - Fixes GHSA-gm62-xv2j-4w53 and GHSA-2xpw-w6gg-jr37

External API Security

• HTTPS enforced for all external API calls
• Rate limiting prevents abuse
• No sensitive data sent to external services (only search queries)

Input Validation

• Pydantic models for strict input validation
• Query sanitization before external API calls
• Length limits on user inputs

Security Best Practices for Users

API Keys

1. Never commit .env files
2. Use environment variables in production
3. Rotate keys periodically
4. Use minimal permissions (read-only where possible)

Deployment

1. Use the provided Docker image for consistency
2. Keep dependencies updated
3. Monitor for security advisories
4. Use HTTPS in production

HuggingFace Spaces

1. Use Secrets (not public variables) for API keys
2. The HF_TOKEN is used server-side only
3. Users don't need their own tokens

Known Security Considerations

Third-Party APIs

DeepBoner queries external biomedical databases:

• PubMed (NCBI)
• ClinicalTrials.gov
• Europe PMC
• OpenAlex

These are trusted public APIs, but:

• Query content is visible to these services
• Rate limits apply
• Availability depends on upstream services

LLM Providers

• OpenAI and HuggingFace process your queries
• Review their privacy policies if handling sensitive research
• Consider on-premise alternatives for sensitive use cases

Local Data

• ChromaDB stores embeddings locally
• Default path: ./chroma_db/
• Contains processed search results (not raw user data)
• Secure or delete when decommissioning

Security Updates

Security updates will be released as patch versions (e.g., 0.1.1) and announced via:

• GitHub Security Advisories
• Release notes

---

"Security is rock solid. We take evidence-based security very seriously." 🔐