| # Security Policy | |
| ## Supported Versions | |
| | Version | Supported | | |
| | ------- | ------------------ | | |
| | 0.1.x | :white_check_mark: | | |
| ## Reporting a Vulnerability | |
| We take security seriously. If you discover a security vulnerability in DeepBoner, please report it responsibly. | |
| ### How to Report | |
| 1. **DO NOT** open a public GitHub issue for security vulnerabilities | |
| 2. Email security concerns to the repository maintainers via GitHub's private vulnerability reporting | |
| 3. Or use GitHub's Security Advisory feature: **Security** tab > **Report a vulnerability** | |
| ### What to Include | |
| - Description of the vulnerability | |
| - Steps to reproduce | |
| - Potential impact | |
| - Suggested fix (if any) | |
| ### Response Timeline | |
| - **Acknowledgment**: Within 48 hours | |
| - **Initial assessment**: Within 7 days | |
| - **Fix timeline**: Depends on severity | |
| - Critical: Within 48 hours | |
| - High: Within 7 days | |
| - Medium: Within 30 days | |
| - Low: Next release cycle | |
| ## Security Measures | |
| ### API Key Handling | |
| - API keys are loaded from environment variables only | |
| - Keys are never logged or exposed in error messages | |
| - `.env` files are gitignored | |
| - No hardcoded credentials in source code | |
| ### Dependency Security | |
| - Regular dependency audits via `pip-audit` | |
| - Security scanning with `bandit` in CI | |
| - Pinned dependencies for reproducibility | |
| - Known CVE fixes: | |
| - `mcp>=1.23.0` - Fixes GHSA-9h52-p55h-vw2f | |
| - `langgraph-checkpoint-sqlite>=3.0.0` - Fixes GHSA-wwqv-p2pp-99h5 | |
| - `urllib3>=2.6.0` - Fixes GHSA-gm62-xv2j-4w53 and GHSA-2xpw-w6gg-jr37 | |
| ### External API Security | |
| - HTTPS enforced for all external API calls | |
| - Rate limiting prevents abuse | |
| - No sensitive data sent to external services (only search queries) | |
| ### Input Validation | |
| - Pydantic models for strict input validation | |
| - Query sanitization before external API calls | |
| - Length limits on user inputs | |
| ## Security Best Practices for Users | |
| ### API Keys | |
| 1. Never commit `.env` files | |
| 2. Use environment variables in production | |
| 3. Rotate keys periodically | |
| 4. Use minimal permissions (read-only where possible) | |
| ### Deployment | |
| 1. Use the provided Docker image for consistency | |
| 2. Keep dependencies updated | |
| 3. Monitor for security advisories | |
| 4. Use HTTPS in production | |
| ### HuggingFace Spaces | |
| 1. Use Secrets (not public variables) for API keys | |
| 2. The HF_TOKEN is used server-side only | |
| 3. Users don't need their own tokens | |
| ## Known Security Considerations | |
| ### Third-Party APIs | |
| DeepBoner queries external biomedical databases: | |
| - PubMed (NCBI) | |
| - ClinicalTrials.gov | |
| - Europe PMC | |
| - OpenAlex | |
| These are trusted public APIs, but: | |
| - Query content is visible to these services | |
| - Rate limits apply | |
| - Availability depends on upstream services | |
| ### LLM Providers | |
| - OpenAI and HuggingFace process your queries | |
| - Review their privacy policies if handling sensitive research | |
| - Consider on-premise alternatives for sensitive use cases | |
| ### Local Data | |
| - ChromaDB stores embeddings locally | |
| - Default path: `./chroma_db/` | |
| - Contains processed search results (not raw user data) | |
| - Secure or delete when decommissioning | |
| ## Security Updates | |
| Security updates will be released as patch versions (e.g., 0.1.1) and announced via: | |
| - GitHub Security Advisories | |
| - Release notes | |
| --- | |
| *"Security is rock solid. We take evidence-based security very seriously."* 🔐 | |