Skip to main content
`Ctrl`+`K`

# Security

The SciPy maintenance team is security conscious and has mechanisms for resolving identified security issues. In general, however, core maintainers are not security experts (their expertise lying elsewhere in scientific domains and programming).

We follow the NumPy security guidelines in addition to this document.

## Data and Network Access

For working with untrusted data the NumPy security guidelines apply.

The majority of SciPy does not establish a network connection. The sole exception to this is the `scipy.datasets` where we rely on the Pooch dependency to fetch data and use sha256 codes to verify downloads.

## Releases

To mitigate the risk of supply chain attacks (as of the v1.18.0 release) we rely on the scipy-release repository which is modeled after the Numpy release process.

General security guidelines on the scipy-release repo:

- We require commit history and audit log are easy to inspect

- We require branch protection etc. and apply best practices

- We require all release artifacts to be built in the scipy-release repo

- We do not allow self-hosted runners on this repository

## Disclosure

To report a security vulnerability on the SciPy repo, please use Tidelift.

SciPy is not designed to be exposed directly to untrusted users. A user who can freely execute SciPy (or Python) functions must be considered to have the same privileges as the process/Python interpreter.

If one can already execute Python code, there are far worse things one can do than use all available CPU cycles, or provoke a symptom of a bug in code like use-after-free or a segfault. Therefore, while such issues may be bugs, they are not security issues.

Before reporting a security issue, please consider and describe the attack vector in detail - and in particular whether that attack vector assumes being able to freely execute SciPy functions.