We take the security of URDU-OCR-CNN seriously. This document outlines our security policy and provides guidance on how to report security vulnerabilities responsibly.

We actively maintain and provide security updates for the following versions:

When using URDU-OCR-CNN, please follow these security best practices:

1. Environment Variables: Never commit sensitive data (API keys, secrets) to the repository. Use environment variables and .env files (which are gitignored).

2. HTTPS: Always use HTTPS in production to encrypt data in transit.

3. Input Validation: The application validates all inputs, but ensure additional validation is performed if extending the API.

4. File Upload Security:

   • Only allow image files (PNG, JPG, JPEG)
   • Limit file sizes to prevent DoS attacks
   • Validate file content, not just extensions

5. CORS Configuration: Configure CORS properly for production environments.

6. Dependencies: Regularly update dependencies to patch known vulnerabilities:

   # Backend
   pip list --outdated
   pip install --upgrade <package>
   
   # Frontend
   npm outdated
   npm update

7. Container Security: If using Docker, use official base images and keep them updated.

1. Virtual Environments: Use Python virtual environments to isolate dependencies.

2. Secure Coding: Follow OWASP guidelines and secure coding practices.

3. Code Review: All code changes should be reviewed before merging.

4. Dependency Scanning: Use tools like safety (Python) or npm audit (Node.js) to scan for vulnerabilities.

We appreciate your efforts to responsibly disclose security vulnerabilities. If you discover a security issue, please follow these steps:

Please DO NOT create a public GitHub issue for security vulnerabilities. This could put our users at risk.

Report security vulnerabilities through one of these channels:

• GitHub Security Advisories: Use GitHub's private vulnerability reporting feature (recommended)
• Email: Contact the maintainers privately through GitHub discussions or by opening an issue with the title "Security Issue - Please Contact Me" (without details)

When reporting a vulnerability, please include:

• Type of vulnerability (e.g., SQL injection, XSS, authentication bypass)
• Location (file path, URL, or line number)
• Step-by-step instructions to reproduce the issue
• Proof of concept (if possible)
• Impact assessment (who/what is affected)
• Suggested fix (if you have one)
• Your contact information for follow-up questions

• Initial Response: We will acknowledge your report within 48 hours
• Status Update: We will provide a status update within 7 days
• Fix Timeline: We aim to release fixes for critical vulnerabilities within 30 days
• Disclosure: We will coordinate public disclosure with you after the fix is released

We follow a coordinated vulnerability disclosure process:

1. You report the vulnerability privately
2. We confirm the issue and develop a fix
3. We release a security update
4. We publicly disclose the vulnerability (crediting you if desired)
5. You may publish your findings after public disclosure

We appreciate security researchers who help keep our project safe. If you report a valid security vulnerability:

• We will credit you in our security advisories (if you wish)
• Your contribution will be acknowledged in our release notes
• We will maintain a "Hall of Fame" for security researchers (with permission)

• Local Processing: Character recognition happens on your server; no data is sent to third parties
• Image Storage: Uploaded images are processed in memory and not stored permanently by default
• Logs: Be cautious about logging sensitive data in production

• This is an open-source project provided "as-is" without warranty
• The CNN model's predictions should not be used for critical security decisions
• Regular security audits are recommended for production deployments

When deploying, configure these security headers:

# Example nginx configuration
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;

We recommend using these tools for security testing:

# Check for known vulnerabilities in dependencies
pip install safety
safety check

# Code security analysis
pip install bandit
bandit -r backend/

# Audit npm packages
npm audit

# Fix automatically (if possible)
npm audit fix

# Scan Docker images
docker scan urdu-ocr-backend
docker scan urdu-ocr-frontend

• OWASP Top 10
• Python Security Best Practices
• React Security Best Practices
• FastAPI Security

For security-related questions that are not vulnerabilities, you can:

• Open a discussion in our GitHub Discussions
• Review our documentation

This security policy may be updated periodically. Please check back regularly for updates.

Last Updated: December 2024

Thank you for helping keep URDU-OCR-CNN and its users safe! 🙏