AITBC is developed privately on Gitea with a public GitHub mirror. To report a security vulnerability:

• GitHub: use private vulnerability reporting (Security → Report a vulnerability), or open a draft security advisory.
• Email: [email protected] — the operator's direct contact.
• Please do not file public issues for unpatched vulnerabilities.

There is no public bug bounty program and no separate security team mailbox; reports go directly to the maintainer.

Security tooling is installed via requirements-dev.txt and run locally or in CI:

1. pip-audit — scans Python packages for known vulnerabilities
2. Bandit — static analysis for Python security issues
3. CodeQL — configuration lives under .github/codeql/ (suppressions.yml)

# Scan Python dependencies (pip-audit; scan tools run in a throwaway venv)
./scripts/security/dependency-scan.sh

# Scan source for hardcoded secrets
./venv/bin/python scripts/security/scan_secrets.py

# Full local audit
./venv/bin/python scripts/security/security_audit.py

• .github/workflows/ci.yml and .gitea/workflows/ci.yml run the test suites, docs validation, port/bind-policy checks, and Foundry contract tests on every push and PR to main. There is currently no separate scheduled dependency-security workflow — scans are run manually with the scripts above.

• Dependabot (.github/dependabot.yml) opens weekly update PRs for pip, npm, and GitHub Actions dependencies (Mondays 09:00, limit 5).
• Manual updates:
  1. Run ./scripts/security/dependency-scan.sh
  2. pip install --upgrade <package>; refresh requirements.txt
  3. Re-run the scan and the test suite
  4. Commit as deps: update <package> to <version>

When vulnerabilities are detected:

1. Critical (CVSS ≥ 9.0): create a private advisory, patch within 24 hours, deploy hotfix if needed.
2. High (CVSS 7.0–8.9): patch within 72 hours, schedule maintenance window.
3. Medium/Low (CVSS < 7.0): include in the next scheduled update; document the risk assessment.

1. Never commit secrets to the repository
2. Use environment variables for sensitive data
3. Run security scans before committing
4. Keep dependencies updated
5. Review dependency licenses for compliance

1. Pin versions in requirements.txt
2. Use virtual environments for isolation
3. Audit new dependencies before adding
4. Minimize attack surface by removing unused dependencies
5. Use requirements-dev.txt for development-only dependencies

1. Security review for code touching sensitive data
2. Input validation on all user inputs
3. Error handling that does not expose sensitive information
4. Authentication/authorization checks on all endpoints
5. Logging without logging sensitive data

Add to .git/hooks/pre-commit:

#!/bin/bash
# Run security scan before commit
./scripts/security/dependency-scan.sh

Enable warnings for:

• Hardcoded secrets
• SQL injection risks
• XSS vulnerabilities
• Insecure deserialization

• pip-audit Documentation
• OWASP Python Security
• GitHub Security Best Practices

Last Updated: 2026-09-19