1.5 KiB
Security policy
Supported versions
Security fixes go into the latest release. Older releases are not patched; upgrade to the newest version.
Reporting a vulnerability
Please do not open a public issue for a security problem. Write privately to [email protected] and include:
- the SimurgArray version (
simurg --version), - what an attacker could do and under which conditions,
- the smallest input or command that shows the problem, without real genetic data.
You will get an answer within a week. Once a fix is released, the report is credited in CHANGELOG.md unless you
prefer otherwise.
What counts
SimurgArray reads files that users download from third parties. Problems worth reporting include:
- crafted IDAT, BPM, CSV, EGT, GTC, VCF or sample sheet files that crash the reader in an unsafe way, write outside the output folder, or execute code;
- HTML reports that run script from their input data (reports are meant to be safe to open and share);
- anything that could leak sample sheet metadata or genetic data beyond what the user chose to include.
Handling genetic data
Genotype data are personal data. SimurgArray never sends data anywhere: it has no network access at run time and
its reports embed everything they need. Users are responsible for storing and sharing outputs according to their
consent and data protection rules. The QC report offers --no-metadata, --drop-metadata and --keep-metadata to
control what it contains.