34 lines
1.5 KiB
Markdown
34 lines
1.5 KiB
Markdown
# Security policy
|
|
|
|
## Supported versions
|
|
|
|
Security fixes go into the latest release. Older releases are not patched; upgrade to the newest version.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please do not open a public issue for a security problem. Contact the maintainer privately through the contact
|
|
details on the maintainer's profile page, https://gitea.yaylali.uk/kemal, and include:
|
|
|
|
* the SimurgArray version (`simurg --version`),
|
|
* what an attacker could do and under which conditions,
|
|
* the smallest input or command that shows the problem, without real genetic data.
|
|
|
|
You will get an answer within a week. Once a fix is released, the report is credited in `CHANGELOG.md` unless you
|
|
prefer otherwise.
|
|
|
|
## What counts
|
|
|
|
SimurgArray reads files that users download from third parties. Problems worth reporting include:
|
|
|
|
* crafted IDAT, BPM, CSV, EGT, GTC, VCF or sample sheet files that crash the reader in an unsafe way, write outside
|
|
the output folder, or execute code;
|
|
* HTML reports that run script from their input data (reports are meant to be safe to open and share);
|
|
* anything that could leak sample sheet metadata or genetic data beyond what the user chose to include.
|
|
|
|
## Handling genetic data
|
|
|
|
Genotype data are personal data. SimurgArray never sends data anywhere: it has no network access at run time and
|
|
its reports embed everything they need. Users are responsible for storing and sharing outputs according to their
|
|
consent and data protection rules. The QC report offers `--no-metadata`, `--drop-metadata` and `--keep-metadata` to
|
|
control what it contains.
|