If you discover a security vulnerability in this ML-MLOps Portfolio project, please report it privately before disclosing it publicly.

Preferred Method:

• Send an email to: DuqueOrtegaMutis@gmail.com
• Use the subject line: Security Vulnerability Report - ML-MLOps-Portfolio

Alternative Methods:

• GitHub's private vulnerability reporting: Report Vulnerability
• Direct message on LinkedIn: Duque Ortega Mutis

Please include the following information in your report:

1. Vulnerability Type (e.g., XSS, SQL injection, dependency issue)
2. Affected Components (specific files, APIs, or dependencies)
3. Impact Assessment (potential damage or risk)
4. Reproduction Steps (detailed steps to reproduce the issue)
5. Proof of Concept (if available)
6. Suggested Mitigation (optional but helpful)

• Initial Response: Within 48 hours
• Assessment: Within 7 business days
• Resolution Timeline: Depends on severity (see below)

The following security aspects are within scope:

• Application code in all three projects (BankChurn, NLPInsight, ChicagoTaxi)
• API endpoints and authentication mechanisms
• Docker container configurations
• CI/CD pipeline security
• Dependency vulnerabilities
• Data handling and storage
• Infrastructure as code (Terraform, K8s manifests)

• Vulnerabilities in third-party dependencies (report to upstream)
• Issues requiring physical access to infrastructure
• Social engineering attacks
• Denial of service attacks against production infrastructure
• Vulnerabilities in outdated versions no longer supported

• Container Security: Multi-stage Docker builds, minimal base images
• Dependency Scanning: Automated security scans in CI/CD (pip-audit, safety)
• Secret Management: No hardcoded secrets, environment-based configuration
• Code Quality: Static analysis with bandit, flake8, mypy
• Access Control: Principle of least privilege in deployment configurations
• Monitoring: Prometheus metrics and Grafana dashboards for security monitoring

• Pydantic Validation: Input sanitization and type checking
• FastAPI Security: CORS configuration, request validation
• MLflow Security: Authentication and authorization for experiment tracking
• Kubernetes Security: Network policies, resource limits, security contexts

We follow coordinated disclosure principles:

1. Private Report: Vulnerabilities are reported privately
2. Assessment: Security team evaluates and validates the report
3. Remediation: Fix is developed and tested
4. Disclosure: Public disclosure after fix is deployed (typically 90 days)

Security researchers will be acknowledged in our security advisories unless they prefer to remain anonymous.

• Published advisories: GitHub Security Advisories
• CVE assignments when applicable

• Lead: Duque Ortega Mutis
• Email: DuqueOrtegaMutis@gmail.com
• GitHub: @DuqueOM

For critical security issues requiring immediate attention:

• Emergency Email: DuqueOrtegaMutis@gmail.com
• Response Time: Within 24 hours

• Low Priority: Included in regular releases
• Medium Priority: Patch releases within 14 days
• High Priority: Security patches within 7 days
• Critical Priority: Emergency patches within 48 hours

• SAST: Static Application Security Testing with bandit
• SCA: Software Composition Analysis with pip-audit
• Container Scanning: trivy for Docker images
• Infrastructure Scanning: tfsec for Terraform configurations

• Penetration Testing: Quarterly security assessments
• Code Reviews: Security-focused code reviews for critical changes
• Architecture Reviews: Security architecture assessments

This security policy is provided "as is" without warranty of any kind. We reserve the right to modify this policy at any time.

Last Updated: February 2026