src/docs/SECURITY.md

# Security review of the serving code

**When and how.** 8 October 2026, a read-only review of the gateway: trace every untrusted input to every sink,
confirm each candidate end to end, keep only findings with confidence 8 of 10 or more.

**Scope.** `crates/diar-gateway`, `crates/diar-triton`, `crates/diar-audio` (decoding untrusted uploads), the
engine's input path, `python/anuvani_diar/client.py`, the Triton models, image and scripts, and the compose stack.
Threat model: clients are untrusted; the gateway binds 127.0.0.1 by default but may be exposed; Triton listens on
127.0.0.1 only; the host may have other local accounts.

## Findings and fixes

| # | Finding | Severity | Fix | Test |
|---|---|---|---|---|
| 1 | The Python client sent its bearer token along any HTTP redirect (urllib copies every request header to the redirect target), so a forged 302 on an exposed, non-TLS deployment would hand the token to another host | medium | the client never follows redirects; a 3xx is an error (the gateway never redirects) | `test_client_does_not_follow_redirects` |
| 2 | The size limit and the memory budget were checked on the decoded audio only; resampling to 16 kHz came after, unchecked, so a file declaring a low sample rate (libsndfile accepts any) could grow up to 16,000 times past both, e.g. 2.4 MB at 1 Hz becoming 38.4 GB | medium | the resampled size, `ceil(frames x 16000 / rate)` samples, is computed from the header with the decoded one; both must be within `--max-audio-gb`, and the budget holds both | `test_a_low_sample_rate_cannot_resample_past_the_limit` (engine and gateway) |
| 3 | Grafana allowed anonymous viewing; on a host with other accounts the loopback is theirs too | low | anonymous access off; the admin password is generated into `artifacts/compose/grafana_password` (mode 0600) | configuration |

Checked and found sound (from the review): the token middleware covers every route but `/health`, with a
constant-time comparison; upload names, uris and spool files (no path separators, exclusive creation with mode
0600 in a directory refused unless it is ours and 0700); path jobs (canonical path under the allowed root, regular
files only, one generic refusal message); no injection into RTTM lines or JSON through `uri`; Triton responses
parsed with checked slicing only; the `unsafe` blocks in decoding and tensor encoding; panics contained per file
(engine) or per request (axum); no token or server path in logs or error messages; every published port on
127.0.0.1, read-only mounts, no privileged containers.

## What remains (by design or out of scope)

- **libsndfile parses untrusted uploads inside the gateway process**, as soundfile does inside the release. A
  parser bug in libsndfile 1.2.2 would take the gateway down. 2,750 damaged files decode exactly as soundfile does
  (`tests/test_audio_decode.py`), which is a check of equivalence, not of libsndfile's own safety. Decoding in a
  separate process would contain such a bug; not done.
- **Without a token, any local account can use the gateway**, and with `--allow-path-root` have it read files under
  that root with your account's rights. `triton/README.md` says to set a token on a shared machine.
- **Path jobs**: the file is opened by its canonical path after the check, so someone who can write inside the
  allowed root could swap a path component in between. That needs write access inside a root the operator chose.
- **Jobs live in the gateway's memory**: a gateway restart loses them; the Python client resubmits (tested), other
  clients must.

## Second review: the FastAPI service (9 October 2026)

A read-only review of `triton_inference/service` (the FastAPI app, its settings, spool, Dockerfile and build script)
and its Rust binding (`crates/diar-py/src/service.rs`), against the pinned libraries (fastapi 0.143.0, starlette
1.7.0, uvicorn 0.54.0, h11 0.16.0, python-multipart 0.0.32). Two findings were confirmed by offline measurement
before they were fixed.

| # | Finding | Severity | Fix | Test |
|---|---|---|---|---|
| 4 | The resampling filter was not counted. torchaudio's sinc filter for a rate `sr` is a (16000 / g, 2 x width + sr / g) table of float64, g = gcd(sr, 16000), whatever the file's length; a 500-byte WAV declaring 16,001 Hz asks for 2 GB per table (measured: +4.2 GB peak, 4.4 s), one declaring 1,000,003 Hz for about 128 GB. Item 2's limits saw only 400 bytes decoded and 8 bytes resampled. This reached the gateway and the pip package too (same engine) | high | the engine computes the filter's size from the header's rate (`resample_filter_bytes`, checked against torchaudio 2.1.1's own tables) and refuses a file whose filter exceeds 64 MiB before anything is resampled; every common rate (8 to 192 kHz) needs under 3 MB. A file the release would have resampled at such a rate is now refused: the one place where the engine's behaviour departs from the release's, for headers no recorder writes | `test_a_rate_that_does_not_reduce_cannot_build_a_huge_resampling_filter` (engine and service); `resample_filter_sizes` (Rust) |
| 5 | Multipart bodies were bounded only in their file part: parts with no data but distinct names of up to 4 KiB each were kept in a dict without limit, and with `Transfer-Encoding: chunked` (no `Content-Length`) nothing capped the non-file bytes (measured: memory grew 1:1 with the bytes sent) | high | at most 16 parts; boundaries, part headers, fields and anything after the closing boundary together within 128 KiB above `--max-upload-mb`, checked while streaming | `test_multipart_framing_is_bounded` |
| 6 | The image's default command listened on 0.0.0.0 and a token was optional, so `docker run --network host` without a token exposed the API on every interface | medium | `--listen` on an address other than the loopback refuses to start without a token, unless `--insecure-no-token` | `test_listening_beyond_the_loopback_needs_a_token` |
| 7 | An unusual spool `OSError` without `strerror` put the spool file's path into the error message | low | a generic message instead | review |

Not changed, recorded:

- **One token, one trust domain.** Any holder of the token can read or cancel any job and replay any
  `Idempotency-Key`. Job ids are 128 random bits, and the result cache answers only for audio the caller sent, so
  nothing leaks between callers who know nothing of each other's jobs; but the service is single-tenant. Several
  tenants need a reverse proxy with per-tenant tokens in front, or per-token scoping (not done).
- **Path jobs** keep the gateway's check-then-open gap (above).
- **Base images** are pinned by tag (`ubuntu:22.04`, `tritonserver:24.10-py3`, `tritonserver:25.06-py3`), not by digest; `/docs` and `/redoc`
  load their JavaScript from cdn.jsdelivr.net (FastAPI's defaults), behind the token.

## Tritons on other machines (10 October 2026)

`diar up --tritons-only --bind ADDR` publishes a machine's Tritons on ADDR so that another machine's service can use
its GPUs (`diar up --remote`). Triton has no authentication: anyone who reaches those ports can run the networks and
read the server's metadata. The Tritons start with `--model-control-mode=none`, so models can be neither loaded nor
unloaded through the API, but the ports must stay on a private network: bind to a private address (the command
refuses to publish without `--bind`), never to a public interface, and firewall the ports to the service's machine.
The service's own token and limits are unchanged.