ITOSMPiano-BachToBasics/SECURITY.md

Security Policy

Scope

Bach to Basics handles no user accounts, no personal data, and no financial information. It is a local music practice tool - the main attack surface is file processing (MIDI, MusicXML, PDF uploads) and the FastAPI backend when self-hosted.

Threat model

Bach to Basics is designed primarily for personal self-hosting - running on localhost or your home network for solo practice. Anything beyond that is a "you opted in" scenario that requires extra configuration (see the README's "Public deployments" section).

In scope for hardening and reports:

• Input-validation flaws in any file-upload endpoint (MIDI, MusicXML, PDF, audio)
• XXE, XML-bomb, or ZIP-bomb attacks via MusicXML / .mxl
• Command injection in subprocess invocations (LilyPond, Audiveris, ffmpeg, yt-dlp, pianoplayer)
• SSRF on the /youtube/extract endpoint
• Path-traversal via uploaded filenames or response Content-Disposition
• API-key authentication bypasses or timing attacks
• CSP, CORS, or security-header regressions on the frontend
• Service-worker cache leaks of /api/* responses (PWA)

Out of scope:

• Multi-tenant user isolation - the app has no concept of users
• Persistent server-side storage hardening - the backend stores nothing beyond ephemeral request-scoped tempfiles
• Distributed-denial-of-service protection beyond the simple per-IP rate limit - use a reverse proxy or CDN for serious traffic
• Vulnerabilities inside third-party optional binaries the user installs themselves (LilyPond, Audiveris JAR, Basic Pitch / TensorFlow, yt-dlp) - report those upstream
• Browser-extension or operating-system-level threats (keyloggers, screen capture, etc.)

What to report

Worth reporting privately:

• Remote code execution or sandbox escape via a crafted MIDI, MusicXML, or PDF file
• Server-side vulnerabilities in the FastAPI backend (path traversal, SSRF, etc.)
• Dependency vulnerabilities with a realistic exploit path

Probably not a security issue (open a regular bug instead):

• Unexpected UI behaviour caused by a malformed music file
• The app crashing or producing wrong output from bad input

Reporting

Use GitHub's private vulnerability reporting:

1. Go to the Security tab of this repo
2. Click "Report a vulnerability"
3. Fill in the details - steps to reproduce, impact, any suggested fix

You'll get a response within a few days. There's no formal embargo policy given the nature of this project, but please give a reasonable heads-up before going public.