ITOSMPiano-BachToBasics/SECURITY.md

Security Policy

Scope

Bach to Basics handles no user accounts, no personal data, and no financial information. It is a local music practice tool - the main attack surface is file processing (MIDI, MusicXML, PDF uploads) and the FastAPI backend when self-hosted.

What to report

Worth reporting privately:

• Remote code execution or sandbox escape via a crafted MIDI, MusicXML, or PDF file
• Server-side vulnerabilities in the FastAPI backend (path traversal, SSRF, etc.)
• Dependency vulnerabilities with a realistic exploit path

Probably not a security issue (open a regular bug instead):

• Unexpected UI behaviour caused by a malformed music file
• The app crashing or producing wrong output from bad input

Reporting

Use GitHub's private vulnerability reporting:

1. Go to the Security tab of this repo
2. Click "Report a vulnerability"
3. Fill in the details - steps to reproduce, impact, any suggested fix

You'll get a response within a few days. There's no formal embargo policy given the nature of this project, but please give a reasonable heads-up before going public.