We provide security updates for the following versions:

Please do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability, please send an email to:

[email protected]

Include the following information:

• Type of vulnerability
• Full paths of source file(s) related to the vulnerability
• Location of the affected source code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the vulnerability

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 5 business days
• Regular Updates: Every 5-7 days until resolution
• Fix Timeline: Varies by severity (critical issues prioritized)

• We will confirm receipt of your report
• We will work with you to understand and validate the issue
• We will develop and test a fix
• We will publicly disclose the vulnerability after a fix is released
• We will credit you for the discovery (unless you prefer to remain anonymous)

Never commit API keys to version control.

Always use environment variables:

export FRED_API_KEY=your_key_here
export CENSUS_API_KEY=your_key_here
export BLS_API_KEY=your_key_here

Or create a local configuration file (excluded from git):

# ~/.krl/apikeys
FRED_API_KEY=your_key_here
CENSUS_API_KEY=your_key_here

• Never include personally identifiable information (PII) in notebooks
• Sanitize or anonymize data before sharing
• Be cautious when publishing notebooks with real data

Keep dependencies up to date:

pip install --upgrade -r requirements.txt

Use our security checks:

pip install pre-commit
pre-commit install
pre-commit run --all-files

This runs:

• Secret detection (gitleaks)
• Security scanning (bandit)
• Code quality checks

We maintain a list of known security issues and their status in our Security Advisory page.

This repository uses:

• gitleaks: Secret detection in commits
• bandit: Python security linter
• safety: Dependency vulnerability scanner
• pre-commit: Automated security checks

For security questions (non-vulnerability related), contact:

[email protected]

© 2025 KR-Labs. All rights reserved.
KR-Labs™ is a trademark of Quipu Research Labs, LLC, a subsidiary of Sundiata Giddasira, Inc.