manifoldbt/SECURITY.md

Security Policy

Supported versions

Security fixes are issued for the latest published release of manifoldbt on PyPI. Older versions are not patched; upgrade with pip install -U manifoldbt.

Reporting a vulnerability

Do not open a public issue for a security problem.

Use GitHub's private reporting: go to the Security tab of this repository and click Report a vulnerability. That opens a private advisory visible only to you and the maintainers.

If you cannot use that, email contact@manifoldbt.com with SECURITY in the subject line.

Please include:

• the version of manifoldbt and of Python, and the operating system
• what an attacker can do with the issue
• a minimal reproduction, ideally a script that runs against public data

What to expect

• Acknowledgement within 5 business days.
• An assessment, with a fix timeline or an explanation of why it is not a vulnerability, within 15 business days.
• Credit in the release notes when a report leads to a fix, unless you prefer otherwise.

Please give us a reasonable window to publish a fix before disclosing publicly.

Scope

In scope: the published manifoldbt package, its data connectors, and its CLI.

Of particular interest: anything that lets untrusted input reach code execution. The library parses files and network responses that a user did not write, including CSV imports and connector payloads, and it deserializes stored data.

Out of scope: the website, third-party forks and redistributions, and findings that require an attacker to already control the machine running the backtest.