The latest version of Unveil is actively maintained for security and stability improvements.

If you discover a security vulnerability, please report it responsibly.

Include:

• vulnerability description
• affected component(s)
• reproduction steps
• possible impact
• screenshots/logs if applicable

Please avoid publicly disclosing vulnerabilities before they are reviewed.

Unveil includes:

• AI/ML pipelines
• explainability systems
• API endpoints
• Firebase integrations
• Gemini-based classification systems
• model evaluation workflows

Security considerations apply to:

• data handling
• model integrity
• inference APIs
• credential management
• dataset exposure
• prompt injection risks

Never commit:

• API keys
• Firebase credentials
• .env files
• access tokens
• production secrets

Use:

• .env.example
• environment variables
• secret management systems

Before pushing code:

git status

Verify sensitive files are excluded.

Contributors should be aware of:

LLM-integrated systems may be vulnerable to:

• prompt manipulation
• jailbreak attempts
• malicious inputs

Validate and sanitize external inputs wherever possible.

Avoid:

• unverified model artifacts
• unsafe pickle loading
• untrusted serialized objects

Only use trusted model files and validated sources.

Because Unveil analyzes fairness and explainability:

• outputs should not be treated as absolute truth
• fairness metrics should be interpreted carefully
• datasets may contain historical bias

Always document assumptions and limitations.

Recommended practices:

• validate request payloads
• sanitize user inputs
• rate-limit endpoints where appropriate
• avoid exposing internal stack traces
• use secure authentication for production deployments

Before deployment:

• audit dependencies regularly
• keep packages updated
• avoid abandoned libraries
• review transitive dependencies

Recommended:

pip list --outdated
npm audit

Frontend contributors should:

• avoid exposing secrets in client-side code
• sanitize rendered content
• validate uploaded data
• avoid insecure DOM injection patterns

Please do NOT:

• exploit vulnerabilities maliciously
• expose private datasets
• leak credentials
• publicly disclose unpatched vulnerabilities

Responsible disclosure helps protect contributors and users.

Unveil is primarily an educational and research-oriented AI transparency project.

It is not guaranteed to be production hardened without additional:

• security review
• infrastructure hardening
• authentication systems
• deployment safeguards

Security, transparency, and responsible AI development are shared responsibilities.

Thank you for helping make Unveil safer and more trustworthy.