Only the latest released version of BOAR receives security fixes.
| Version | Supported |
|---|---|
| 1.x (latest) | ✅ |
| < 1.0 | ❌ |
Please do not report security vulnerabilities through public GitHub Issues.
If you discover a security vulnerability in BOAR, please report it responsibly:
- Email the maintainers at the address listed in
pyproject.toml(or open a GitHub Security Advisory via the "Report a vulnerability" button on the repository's Security tab). - Include as much detail as possible:
- Description of the vulnerability and its potential impact.
- Steps to reproduce or a proof-of-concept (if available).
- Affected version(s).
- Any suggested mitigations.
We will acknowledge receipt within 5 business days and aim to provide a fix or mitigation within 90 days, depending on severity.
BOAR is a scientific calibration tool intended to be run in trusted, local or HPC environments. The following areas are most relevant from a security perspective:
| Area | Notes |
|---|---|
| File I/O | BOAR reads user-supplied YAML configs and HDF5 model output files. Malformed or malicious input files could cause unexpected behaviour. |
| Subprocess execution | BOAR may invoke external hydrodynamic model executables (e.g., BASEMENT). Ensure model binaries and configuration paths come from trusted sources. |
| Dependencies | Third-party packages (numpy, torch, optuna, etc.) are audited via pip-audit in CI. Keep your environment up to date. |
- Vulnerabilities in the underlying hydrodynamic modelling software (e.g., BASEMENT).
- Issues arising from running BOAR with untrusted user-supplied model executables.
- General Python runtime or OS-level vulnerabilities.
- Dependency auditing:
pip-auditis run in CI on every push. - Static analysis:
banditscans the source code for common security issues on every push. - Minimal permissions: BOAR does not require network access or elevated system privileges during normal operation.
Once a fix is released, we will:
- Publish a GitHub Security Advisory with the CVE (if applicable).
- Credit the reporter (unless they prefer to remain anonymous).
- Tag a new release with the patch.
Thank you for helping keep BOAR and its users safe.