Security Policy

Supported Versions

We release patches for security vulnerabilities in the following versions:

Reporting a Vulnerability

We take the security of AI Web Feeds seriously. If you believe you have found a security vulnerability, please report it to us as described below.

How to Report

What to Include

Please include the following information in your report:

• Type of issue: buffer overflow, SQL injection, XSS, etc.
• Affected files: Full paths of source files related to the issue
• Source location: Tag/branch/commit or direct URL
• Configuration: Any special configuration required to reproduce
• Reproduction steps: Step-by-step instructions to reproduce the issue
• Proof-of-concept: Exploit code or PoC (if possible)
• Impact assessment: How an attacker might exploit the vulnerability

Response Timeline

Disclosure Policy

• We prefer to fully remediate vulnerabilities before public disclosure
• We will coordinate disclosure timing with you
• We will credit you in the security advisory (unless you prefer anonymity)
• We ask that you avoid public disclosure until we've had time to address the issue

Safe Harbor

We support safe harbor for security researchers who:

Scope

In Scope ✅

The following components are in scope for security reports:

• AI Web Feeds CLI tool
• AI Web Feeds web application
• Feed processing and validation logic
• Data schema and validation
• CI/CD workflows that could impact security
• API endpoints and data handling
• Authentication and authorization mechanisms

Out of Scope ❌

The following are out of scope:

• Social engineering attacks
• Physical attacks against infrastructure
• Attacks requiring physical access to user devices
• Denial of service attacks
• Issues in third-party services or libraries (report to respective projects)
• Publicly disclosed vulnerabilities (already known)

Security Best Practices for Contributors

When contributing to AI Web Feeds, follow these security best practices:

from pydantic import BaseModel, HttpUrl, validator

class FeedInput(BaseModel):
    url: HttpUrl
    name: str

    @validator('name')
    def validate_name(cls, v):
        if len(v) > 200:
            raise ValueError('Name too long')
        return v.strip()

# Check for vulnerabilities
pip-audit

# Update dependencies safely
pip install --upgrade package-name

import os
from dotenv import load_dotenv

load_dotenv()
api_key = os.getenv('API_KEY')  # Never hardcode!

Automated Security

We use several automated tools to maintain security:

Dependency Scanning

• Dependabot: Automatically checks for vulnerable dependencies
• pip-audit: Scans Python packages for known vulnerabilities
• npm audit: Scans Node.js packages for security issues

Code Analysis

• CodeQL: Automated security scanning of code
• Ruff: Python linter with security rules
• ESLint: JavaScript/TypeScript security linting

CI/CD Security

• Dependency Review: Reviews dependency changes in PRs
• Secret Scanning: Prevents accidental secret commits
• Security Policy Enforcement: Automated checks for security requirements

Security Updates

Security updates are released according to severity:

Security Advisories

Security advisories are published at: github.com/wyattowalsh/ai-web-feeds/security/advisories

Subscribe to receive notifications:

• Watch the repository
• Enable security alerts in your GitHub settings
• Subscribe to release notifications

Common Security Scenarios

Feed URL Validation

from ai_web_feeds.models import FeedSource
from pydantic import HttpUrl

# Always validate URLs
def add_feed(url: str) -> FeedSource:
    # Pydantic validates URL format
    validated_url = HttpUrl(url)

    # Additional checks
    if validated_url.scheme not in ['http', 'https']:
        raise ValueError("Invalid URL scheme")

    return FeedSource(url=str(validated_url))

SQL Injection Prevention

from sqlmodel import select, Session

# ✅ Good: Using parameterized queries
def get_feed_by_name(session: Session, name: str):
    statement = select(FeedSource).where(FeedSource.name == name)
    return session.exec(statement).first()

# ❌ Bad: String interpolation (vulnerable to SQL injection)
# def get_feed_by_name(session: Session, name: str):
#     query = f"SELECT * FROM feedsource WHERE name = '{name}'"
#     return session.exec(query)

XSS Prevention in Web UI

// ✅ Good: React automatically escapes content
function FeedTitle({ title }: { title: string }) {
  return <h1>{title}</h1>; // Escaped by default
}

// ❌ Bad: dangerouslySetInnerHTML without sanitization
// function FeedContent({ html }: { html: string }) {
//   return <div dangerouslySetInnerHTML={{ __html: html }} />;
// }

Recognition

We appreciate the security research community's efforts to responsibly disclose vulnerabilities.

Contributors who report valid security issues will be:

• ✅ Credited in the security advisory (if desired)
• ✅ Listed in our security acknowledgments
• ✅ Recognized in our Hall of Fame
• ✅ Eligible for potential rewards (to be determined)

Additional Resources

• OWASP Top 10
• GitHub Security Best Practices
• Python Security Best Practices
• Node.js Security Best Practices

Contact

For general security questions (not vulnerability reports):

• Open a GitHub Discussion
• Email: wyattowalsh@gmail.com