Skip to content

SECURITY.md

Latest commit

 

History

History
93 lines (74 loc) · 2.55 KB

SECURITY.md

File metadata and controls

93 lines (74 loc) · 2.55 KB
Raw

Security Updates and Best Practices

Recent Security Improvements

1. Dependency Updates

  • Python: Upgraded from 3.7.9 (EOL) to 3.11.9
  • FastAI: Updated to 2.7.14
  • PyTorch: Updated to 2.2.1
  • All dependencies: Updated to latest secure versions

2. Server Security Enhancements

Input Validation

  • File size limits (10MB max)
  • File type validation (images only: JPEG, PNG, GIF, BMP, WebP)
  • Filename sanitization
  • Empty file checks

Rate Limiting

  • 30 requests per minute per IP (configurable)
  • In-memory rate limiting for DDoS protection

Security Headers

  • Content-Security-Policy (CSP)
  • X-Frame-Options: DENY
  • X-Content-Type-Options: nosniff
  • X-XSS-Protection: 1; mode=block
  • Referrer-Policy: strict-origin-when-cross-origin

CORS Configuration

  • Configurable allowed origins (no longer wildcard)
  • Credentials support with specific origins

Error Handling

  • Generic error messages to prevent information leakage
  • Proper logging without exposing sensitive data
  • Graceful model loading failures

3. Docker Security

  • Non-root user execution
  • Minimal base image (python:3.11.9-slim)
  • Health checks included
  • No cache for pip installations

4. Configuration Management

  • Environment variables for sensitive data
  • .env file support with python-dotenv
  • Example configuration file provided
  • Model URL no longer hardcoded

Configuration

Create a .env file based on .env.example:

PORT=5000
MODEL_URL=your_model_url_here
ALLOWED_ORIGINS=http://localhost:5000,https://yourdomain.com
MAX_FILE_SIZE_MB=10
RATE_LIMIT_PER_MINUTE=30

Security Checklist

✅ Dependencies updated to latest versions ✅ Input validation on all user inputs ✅ Rate limiting implemented ✅ Security headers configured ✅ CORS properly configured ✅ Error handling prevents information leakage ✅ Docker container runs as non-root user ✅ Environment variables for configuration ✅ File size and type restrictions ✅ Request timeouts configured ✅ Health check endpoint available

Monitoring

The application includes:

  • Structured logging with timestamps
  • Health check endpoint at /health
  • Error tracking with stack traces (in logs only)

Future Recommendations

  1. Add authentication for production use
  2. Implement database for persistent rate limiting
  3. Add request signing/validation
  4. Consider using a reverse proxy (nginx) in production
  5. Implement monitoring and alerting
  6. Add automated security scanning in CI/CD
  7. Regular dependency updates schedule
  8. Consider implementing CAPTCHA for additional bot protection