Open a private security advisory rather than a public issue. If that is unavailable to you, email vanshwar@gmail.com with SECURITY in the subject.

Expect a first reply within seven days. This is a single-author portfolio project, not a funded product — the honest commitment is that a report will be read and answered, not that a patch will ship on a schedule.

A read-only inference service over a public football dataset (a Kaggle mirror of Transfermarkt data; its usage rights are discussed in docs/DATASET_CARD.md, not here).

• No authentication, and none intended. Every endpoint is public and every response is derived from public data. There is no session, no cookie and no account. Deploy it behind your own gateway if you need access control.
• No personal data beyond the public record. Player biography, appearances and published market valuations. No contact details, no private information, nothing scraped. See docs/DATASET_CARD.md.
• No writes. No endpoint mutates state, uploads a file, or accepts a model. docker-compose.yml mounts models/ read-only.
• No secrets in the image. Kaggle credentials are needed only by scripts/fetch_data.py at build-your-own-dataset time, never by the service. .env is gitignored and .env.example carries no real values.

Model deserialisation. src/models/artifact.py loads artifacts with joblib.load, which unpickles and therefore executes whatever the file contains. The artifact_version check runs after that, so it is a compatibility guard and never a security one.

This is accepted rather than overlooked, and the reasoning is in the function's own docstring: nothing downloads an artifact, no endpoint accepts one, and the deployment mounts models/ read-only. The threat requires an attacker who can already write to the model directory, at which point the pickle is not the weakest thing they control.

Load only artifacts you produced. Replacing joblib with ONNX or the booster's own text dump would remove the assumption instead of documenting it, at the cost of the fitted preprocessing travelling inside the same object — which is the property that stops training and serving drifting apart. It is on the roadmap as a deliberate trade, not a pending fix.

Audited 2026-10-19 with npm audit and pip-audit against the committed locks.

After the upgrades: npm audit --omit=dev reports 0 vulnerabilities, npm audit reports the 5 braces-chain entries above, pip-audit reports none for either lock. Advisory databases change; rerun both before relying on this table.

Measured in plans/07-adversarial-audit.md and plans/08-staff-engineering-pass.md:

CI additionally fails the build if any local filesystem path or host inventory appears anywhere in the commit history.

The intended deployment is a public, read-only demonstration: no accounts, no writes, public data. Authentication is deliberately absent, and adding it would protect nothing. What a public deployment needs instead is protection from being run out of resources. Each item is either enforced by the API, set in the container, or left to the reverse proxy, which is the only place it can be enforced correctly.

A minimal nginx front for the API, as a starting point rather than a tuned configuration. It has not been run against this service; nothing in this repository tests a proxy, so rate limiting, timeouts and TLS are a deployment requirement, not a verified property:

limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

server {
    listen 443 ssl;
    client_max_body_size 64k;

    location / {
        limit_req zone=api burst=20 nodelay;
        proxy_read_timeout 10s;
        proxy_pass http://api:8000;
    }
}

These were tested without load testing: the body limit, load shedding, slot release, readiness and the SHAP cache each have a unit test (tests/unit/test_api.py::TestDeploymentSafeguards). No sustained-traffic measurement has been made, and none is claimed.

Denial of service through sheer request volume beyond the safeguards above. That is what the reverse proxy's rate limit is for; without one, this service should not be exposed directly to the internet.