Do NOT open a public issue for security vulnerabilities.

Instead, please report them via one of these channels:

1. Email: security@thedataenginex.dev
2. GitHub Security Advisories: Use the "Report a vulnerability" button on the Security tab

• Description of the vulnerability
• Steps to reproduce
• Potential impact assessment
• Suggested fix (if any)

We follow coordinated disclosure. We will credit reporters in the security advisory unless they prefer to remain anonymous.

DataEngineX follows these security practices:

• No hardcoded secrets — all credentials via environment variables
• Parameterized queries — never SQL concatenation
• Input validation — Pydantic models at API boundaries
• Dependency auditing — automated via uv run poe security
• Pickle safety — SafeUnpickler with HMAC verification for model loading
• Container security — non-root users, minimal base images
• HTTPS only — all production traffic encrypted
• Least privilege — minimal permissions for service accounts

This table is illustrative, not exhaustive.

Run security audits locally:

uv run poe security  # pip-audit for vulnerabilities

CI runs pip-audit and dependency scanning on every PR.