If you discover a security vulnerability in OMNIGEN, please report it privately.
Do not open a public GitHub issue for security vulnerabilities.
Report via: GitHub Security Advisories on this repository (Repository → Security → Report a vulnerability)
Include in your report:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested remediation (if known)
You will receive acknowledgement within 72 hours. If confirmed, a fix will be issued within 14 days for critical issues and 30 days for others.
In scope:
- Code execution vulnerabilities in the OMNIGEN Python package
- SQL injection risks in
omnigen/db/queries/ - Secrets exposure in configuration or logs
- Clinical data integrity bypass (particularly
assert_clinical_integrity()) - Authentication or authorisation issues in the FastAPI layer
Out of scope:
- Vulnerabilities in third-party dependencies (report to the upstream project)
- Issues in locally deployed Docker containers that require physical access
- Social engineering attacks
- Issues only reproducible with malicious data placed directly in the database
OMNIGEN is a research prototype and is not deployed in any clinical setting. It does not process live patient data, does not connect to hospital systems, and is not subject to HIPAA, GDPR clinical provisions, or equivalent regulations in its current form.
All data used during development (TRACERx, GENIE BPC, TCGA-LUAD) is accessed under approved data use agreements and handled in local compute environments only.
Any researcher using OMNIGEN with DUA-gated patient data is solely responsible for complying with the terms of those agreements and applicable data protection regulations in their jurisdiction.