DocuScope AI is currently in active development and does not yet publish stable releases.

Security fixes are applied on a best-effort basis to the default branch.

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them privately through GitHub Security Advisories (private vulnerability reporting): open the repository's Security tab → Report a vulnerability. This creates a private advisory visible only to the maintainer until a fix is ready.

When submitting a report, please include:

• A clear description of the issue
• Affected component(s) or file(s)
• Steps to reproduce
• Proof of concept, sample payload, or screenshots if safe to share
• The potential impact
• Any suggested fix or mitigation

This repository processes documents and extracted text, so security reports are especially welcome for issues involving:

• Unauthorized access to uploaded or scanned documents
• Exposure of sensitive data in logs, exports, or intermediate files
• Broken masking / redaction of PII or confidential content
• Insecure file parsing or upload handling
• Path traversal
• Arbitrary file read/write
• Remote code execution
• Injection vulnerabilities
• Authentication or authorization flaws
• Dependency or supply-chain issues with practical impact
• Secrets committed to the repository
• AI / prompt-injection cases that cause unauthorized data disclosure
• OCR or document-processing flows that expose raw private content unexpectedly

The following are generally out of scope unless they create a clear, demonstrable security impact:

• Typographical or documentation errors
• Feature requests
• Theoretical issues without a realistic exploit path
• Denial-of-service requiring unrealistic resources (note: single-file resource-exhaustion cases — zip-bomb DOCX/XLSX, PDF page-count bombs, image decompression bombs — are in scope, since these are explicitly mitigated; see app/security/resource_guards.py)
• Vulnerabilities only affecting unsupported code versions
• Problems in third-party services outside this repository’s control

We aim to:

• Acknowledge reports within 3 business days
• Triage and validate the issue
• Keep the reporter informed during investigation
• Develop a fix or mitigation when appropriate
• Disclose details publicly only after remediation or coordinated disclosure

Contributors should:

• Never commit secrets, API keys, tokens, or credentials
• Use .env files locally and keep real secrets out of version control
• Validate and sanitize all file inputs
• Treat uploaded files and extracted text as potentially sensitive
• Avoid logging raw confidential document contents
• Keep dependencies updated
• Review exports to ensure no sensitive data is unintentionally preserved
• Apply least privilege to any storage, API, or model integrations

Because DocuScope AI analyzes documents and may use hybrid or AI-assisted classification:

• Model output must not be treated as inherently trustworthy
• Sensitive content should be masked before storage or export whenever possible
• Prompt injection and malicious document content should be considered in testing
• Sanitized outputs should be verified to ensure redaction actually occurred
• Debugging and error traces should not reveal private document contents

Implemented mitigations (Anthropic Claude fallback layer, app/ai/):

• The AI layer only ever receives text that has already passed through the privacy/masking layer (app/privacy/sanitizer.py) — raw document content is never sent to the model.
• Document text is wrapped in explicit delimiters with an instruction that it is untrusted data, never instructions to follow (app/ai/prompts.py) — the concrete defense against prompt-injection attempts embedded in document content.
• Every model response is validated against a strict schema before use (app/ai/schemas.py); a classification label outside the known document classes, or a malformed response, is rejected rather than trusted.
• The AI-generated summary is additionally re-scanned with the same PII detector used upstream (detect_pii) and rejected if it looks like it contains PII-shaped content — concretely verifying that redaction held, even for output the model produced itself.
• Any AI-layer failure (unavailable, timeout, invalid response) degrades to the existing deterministic rules/keyword logic; it never crashes document processing or silently returns unvalidated model output.

We follow coordinated disclosure:

1. Private report received
2. Vulnerability validated
3. Fix or mitigation prepared
4. Patch released to supported code
5. Public advisory shared when appropriate

For this repository, it is strongly recommended to enable:

• Private vulnerability reporting through GitHub Security
• Dependabot alerts and updates for Python dependencies
• Secret scanning and push protection
• Code scanning where available

GitHub documents SECURITY.md reporting guidance, and GitHub also provides security features such as dependency alerts, Dependabot, secret protection, and code scanning for supported repositories and plans. :contentReference[oaicite:2]{index=2}