We assume the Nexus-RTB engine operates in a hostile environment where:
- External Input (Bid Requests) is untrusted and potentially malicious.
- Model Artifacts could be tampered with if the S3 bucket/storage is compromised.
- Budget Control is critical; failure leads to financial loss.
| Threat | Surface | Mitigation Strategy |
|---|---|---|
| RCE via Pickle | ModelLoader |
Safe Loading via NumPy. The engine defaults to .npz files using allow_pickle=False. Legacy .pkl files require a valid SHA256 signature. |
| DoS (Memory) | BidRequest |
Input Truncation. All string inputs (UA, URL) are truncated to 512 chars before hashing. Strict Pydantic types enforce schema. |
| Budget Drain | PacingController |
Atomic Circuit Breakers. Hard constraints on Daily ($25M), Hourly ($2M), and Minute ($50k) spend. Fails closed if limits are hit. |
| Data Poisoning | Training |
Outlier detection. Updates with erratic gradients are discarded. |
- Dependencies: All packages pinned in
requirements.txt. - Secrets: No hardcoded API keys. Configuration via
os.environonly. - Images: Distroless or Slim Docker images to reduce attack surface.
- Financial Safety: Logic gates prevent bidding if ROI < 0 or if win rate deviates significantly (
> 50%).
Please report security issues to security-team@nexus-rtb.internal (Mock).
DO NOT create public GitHub issues for security vulnerabilities.
Last Audit: February 2026