{
  "__type": "IngestedDoc",
  "__tag": 4010,
  "_content": {},
  "_ordered_sections": [],
  "item_file": null,
  "item_line": null,
  "item_type": null,
  "aliases": [],
  "example_section_data": {
    "__type": "Section",
    "__tag": 4015,
    "children": [],
    "title": [],
    "level": 0,
    "target": null
  },
  "see_also": [],
  "signature": null,
  "references": null,
  "qa": "tutorial:security",
  "arbitrary": [
    {
      "__type": "Section",
      "__tag": 4015,
      "children": [
        {
          "__type": "Paragraph",
          "__tag": 4045,
          "children": [
            {
              "__type": "Text",
              "__tag": 4046,
              "value": "The SciPy maintenance team is security conscious and has mechanisms for resolving identified security issues. In general, however, core maintainers are not security experts (their expertise lying elsewhere in scientific domains and programming)."
            }
          ]
        },
        {
          "__type": "Paragraph",
          "__tag": 4045,
          "children": [
            {
              "__type": "Text",
              "__tag": 4046,
              "value": "We follow the "
            },
            {
              "__type": "CrossRef",
              "__tag": 4002,
              "value": "numpy:reference/security",
              "reference": {
                "__type": "LocalRef",
                "__tag": 4022,
                "kind": "docs",
                "path": "tutorial:numpy:reference:security"
              },
              "kind": "docs"
            },
            {
              "__type": "Text",
              "__tag": 4046,
              "value": " guidelines in addition to this document."
            }
          ]
        }
      ],
      "title": [
        {
          "__type": "Text",
          "__tag": 4046,
          "value": "Security"
        }
      ],
      "level": 0,
      "target": "security"
    },
    {
      "__type": "Section",
      "__tag": 4015,
      "children": [
        {
          "__type": "Paragraph",
          "__tag": 4045,
          "children": [
            {
              "__type": "Text",
              "__tag": 4046,
              "value": "For working with untrusted data the "
            },
            {
              "__type": "CrossRef",
              "__tag": 4002,
              "value": "numpy:reference/security",
              "reference": {
                "__type": "LocalRef",
                "__tag": 4022,
                "kind": "docs",
                "path": "tutorial:numpy:reference:security"
              },
              "kind": "docs"
            },
            {
              "__type": "Text",
              "__tag": 4046,
              "value": " guidelines apply."
            }
          ]
        },
        {
          "__type": "Paragraph",
          "__tag": 4045,
          "children": [
            {
              "__type": "Text",
              "__tag": 4046,
              "value": "The majority of SciPy does not establish a network connection. The sole exception to this is the "
            },
            {
              "__type": "CrossRef",
              "__tag": 4002,
              "value": "scipy.datasets",
              "reference": {
                "__type": "LocalRef",
                "__tag": 4022,
                "kind": "module",
                "path": "scipy.datasets"
              },
              "kind": "module"
            },
            {
              "__type": "Text",
              "__tag": 4046,
              "value": " where we rely on the "
            },
            {
              "__type": "Link",
              "__tag": 4049,
              "children": [
                {
                  "__type": "Text",
                  "__tag": 4046,
                  "value": "Pooch"
                }
              ],
              "url": "https://www.fatiando.org/pooch/latest/",
              "title": ""
            },
            {
              "__type": "Text",
              "__tag": 4046,
              "value": " dependency to fetch data and use sha256 codes to verify downloads."
            }
          ]
        }
      ],
      "title": [
        {
          "__type": "Text",
          "__tag": 4046,
          "value": "Data and Network Access"
        }
      ],
      "level": 1,
      "target": null
    },
    {
      "__type": "Section",
      "__tag": 4015,
      "children": [
        {
          "__type": "Paragraph",
          "__tag": 4045,
          "children": [
            {
              "__type": "Text",
              "__tag": 4046,
              "value": "To mitigate the risk of supply chain attacks (as of the v1.18.0 release) we rely on the "
            },
            {
              "__type": "Link",
              "__tag": 4049,
              "children": [
                {
                  "__type": "Text",
                  "__tag": 4046,
                  "value": "scipy-release"
                }
              ],
              "url": "https://github.com/scipy/scipy-release",
              "title": ""
            },
            {
              "__type": "Text",
              "__tag": 4046,
              "value": " repository which is modeled after the "
            },
            {
              "__type": "Link",
              "__tag": 4049,
              "children": [
                {
                  "__type": "Text",
                  "__tag": 4046,
                  "value": "Numpy release"
                }
              ],
              "url": "https://github.com/numpy/numpy-release",
              "title": ""
            },
            {
              "__type": "Text",
              "__tag": 4046,
              "value": " process."
            }
          ]
        },
        {
          "__type": "Paragraph",
          "__tag": 4045,
          "children": [
            {
              "__type": "Text",
              "__tag": 4046,
              "value": "General security guidelines on the scipy-release repo:"
            }
          ]
        },
        {
          "__type": "BulletList",
          "__tag": 4053,
          "ordered": false,
          "start": 1,
          "children": [
            {
              "__type": "ListItem",
              "__tag": 4054,
              "children": [
                {
                  "__type": "Paragraph",
                  "__tag": 4045,
                  "children": [
                    {
                      "__type": "Text",
                      "__tag": 4046,
                      "value": "We require commit history and audit log are easy to inspect"
                    }
                  ]
                }
              ]
            },
            {
              "__type": "ListItem",
              "__tag": 4054,
              "children": [
                {
                  "__type": "Paragraph",
                  "__tag": 4045,
                  "children": [
                    {
                      "__type": "Text",
                      "__tag": 4046,
                      "value": "We require branch protection etc. and apply best practices"
                    }
                  ]
                }
              ]
            },
            {
              "__type": "ListItem",
              "__tag": 4054,
              "children": [
                {
                  "__type": "Paragraph",
                  "__tag": 4045,
                  "children": [
                    {
                      "__type": "Text",
                      "__tag": 4046,
                      "value": "We require all release artifacts to be built in the scipy-release repo"
                    }
                  ]
                }
              ]
            },
            {
              "__type": "ListItem",
              "__tag": 4054,
              "children": [
                {
                  "__type": "Paragraph",
                  "__tag": 4045,
                  "children": [
                    {
                      "__type": "Text",
                      "__tag": 4046,
                      "value": "We do not allow self-hosted runners on this repository"
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "title": [
        {
          "__type": "Text",
          "__tag": 4046,
          "value": "Releases"
        }
      ],
      "level": 1,
      "target": null
    },
    {
      "__type": "Section",
      "__tag": 4015,
      "children": [
        {
          "__type": "Paragraph",
          "__tag": 4045,
          "children": [
            {
              "__type": "Text",
              "__tag": 4046,
              "value": "To report a security vulnerability on the SciPy repo, please use "
            },
            {
              "__type": "Link",
              "__tag": 4049,
              "children": [
                {
                  "__type": "Text",
                  "__tag": 4046,
                  "value": "Tidelift"
                }
              ],
              "url": "https://tidelift.com/docs/security",
              "title": ""
            },
            {
              "__type": "Text",
              "__tag": 4046,
              "value": "."
            }
          ]
        },
        {
          "__type": "Paragraph",
          "__tag": 4045,
          "children": [
            {
              "__type": "Text",
              "__tag": 4046,
              "value": "SciPy is not designed to be exposed directly to untrusted users. A user who can freely execute SciPy (or Python) functions must be considered to have the same privileges as the process/Python interpreter."
            }
          ]
        },
        {
          "__type": "Paragraph",
          "__tag": 4045,
          "children": [
            {
              "__type": "Text",
              "__tag": 4046,
              "value": "If one can already execute Python code, there are far worse things one can do than use all available CPU cycles, or provoke a symptom of a bug in code like use-after-free or a segfault. Therefore, while such issues may be bugs, they are not security issues."
            }
          ]
        },
        {
          "__type": "Paragraph",
          "__tag": 4045,
          "children": [
            {
              "__type": "Text",
              "__tag": 4046,
              "value": "Before reporting a security issue, please consider and describe the attack vector in detail - and in particular whether that attack vector assumes being able to freely execute SciPy functions."
            }
          ]
        }
      ],
      "title": [
        {
          "__type": "Text",
          "__tag": 4046,
          "value": "Disclosure"
        }
      ],
      "level": 1,
      "target": null
    }
  ],
  "local_refs": []
}