Skip to content

Security: KatherLab/deidentifier

Security

.github/SECURITY.md

Security Policy

Thanks for helping keep this project and its users safe. This document covers how to report a vulnerability. For the security posture of the application itself — threat model, data flow, deployment checklist — see docs/SECURITY.md and the companion documents in docs/.

⚠️Evaluation tool. This is an internal evaluation tool. It is not a certified medical device, and its output does not establish legal anonymization. The deploying institution is the data controller and is responsible for its own security review, DPIA, and information-governance sign-off before processing real patient data.

Supported versions

This is an actively developed research project. Only the latest release and the main branch receive security fixes. Please upgrade before reporting, in case the issue has already been addressed.

VersionSupported
Latest release✅
main✅
Older releases❌

Reporting a vulnerability

Please do not open a public GitHub issue for security vulnerabilities.

Report privately through either channel:

  1. GitHub Security Advisories (preferred) — use the Report a vulnerability button on the repository's Security tab. This keeps the report private and lets us collaborate on a fix.
  2. Email — contact the maintainer at fabian.wolf2@tu-dresden.de with the subject line [deidentifier security].

Please include, where possible:

  • a description of the vulnerability and its impact,
  • steps to reproduce (proof of concept, affected endpoint, configuration),
  • the version or commit hash and the deployment mode (detectors enabled, OCR engine, Docker or local),
  • any suggested remediation.

🚫 Never attach a real clinical document. Reproduce with synthetic text — backend/tests/files/ contains examples — and attach that instead.

Anonymization failures

A missed identifier is a known limitation, not a vulnerability: no detector finds everything, which is why human review is part of the design. Report those as normal issues (with synthetic reproduction), or better, quantify them with the evaluation harness.

Do report as a security issue anything that makes the tool claim more than it checked, for example:

  • a redacted PDF export whose blackout can be reversed or whose text remains extractable,
  • document content appearing in logs or in an API response that should not carry it,
  • a status of PASS while redacted content demonstrably remains in the output,
  • a path by which one user could reach another user's document or result.

What to expect

  • Acknowledgement: we aim to confirm receipt within 5 business days.
  • Assessment: we investigate and keep you updated on findings and planned remediation.
  • Disclosure: we follow coordinated disclosure. Please allow a reasonable window for a fix before public disclosure. We are happy to credit reporters in the release notes unless you prefer to stay anonymous.

As a small research team we cannot offer a paid bug bounty, but we genuinely appreciate responsible disclosure.

Scope

In scope: the FastAPI backend, the Vue frontend, the anonymization pipeline, the redacted-PDF export, and the official Docker images.

Out of scope: vulnerabilities in third-party dependencies (report those upstream; we track them via Dependabot and the security workflow), issues that require a compromised host, the absence of authentication (deliberate — the app is designed to run behind an institutional auth proxy), and misconfiguration already called out in docs/SECURITY.md.

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Overview · KatherLab/deidentifier · GitHub
Skip to content
Security: KatherLab/deidentifier
Security

.github/SECURITY.md

Security Policy
Thanks for helping keep this project and its users safe. This document covers
how to report a vulnerability. For the security posture of the application
itself — threat model, data flow, deployment checklist — see
docs/SECURITY.md and the companion documents in
docs/.
⚠️Evaluation tool. This is an internal evaluation tool. It is not a
certified medical device, and its output does not establish legal
anonymization. The deploying institution is the data controller and is
responsible for its own security review, DPIA, and information-governance
sign-off before processing real patient data.
Supported versions
This is an actively developed research project. Only the latest release and
the main branch receive security fixes. Please upgrade before reporting, in
case the issue has already been addressed.
VersionSupported
Latest release✅
main✅
Older releases❌
Reporting a vulnerability
Please do not open a public GitHub issue for security vulnerabilities.
Report privately through either channel:
  1. GitHub Security Advisories (preferred) — use the
Report a vulnerability
button on the repository's Security tab. This keeps the report private and
lets us collaborate on a fix.
  2. Email — contact the maintainer at fabian.wolf2@tu-dresden.de with
the subject line [deidentifier security].
Please include, where possible:
  • a description of the vulnerability and its impact,
  • steps to reproduce (proof of concept, affected endpoint, configuration),
  • the version or commit hash and the deployment mode (detectors enabled, OCR
engine, Docker or local),
  • any suggested remediation.
🚫 Never attach a real clinical document. Reproduce with synthetic text —
backend/tests/files/ contains examples — and attach that instead.
Anonymization failures
A missed identifier is a known limitation, not a vulnerability: no detector
finds everything, which is why human review is part of the design. Report those
as normal issues (with synthetic reproduction), or better, quantify them with
the evaluation harness.
Do report as a security issue anything that makes the tool claim more than it
checked, for example:
  • a redacted PDF export whose blackout can be reversed or whose text remains
extractable,
  • document content appearing in logs or in an API response that should not
carry it,
  • a status of PASS while redacted content demonstrably remains in the output,
  • a path by which one user could reach another user's document or result.
What to expect
  • Acknowledgement: we aim to confirm receipt within 5 business days.
  • Assessment: we investigate and keep you updated on findings and planned
remediation.
  • Disclosure: we follow coordinated disclosure. Please allow a
reasonable window for a fix before public disclosure. We are happy to credit
reporters in the release notes unless you prefer to stay anonymous.
As a small research team we cannot offer a paid bug bounty, but we genuinely
appreciate responsible disclosure.
Scope
In scope: the FastAPI backend, the Vue frontend, the anonymization
pipeline, the redacted-PDF export, and the official Docker images.
Out of scope: vulnerabilities in third-party dependencies (report those
upstream; we track them via Dependabot and the security workflow), issues that
require a compromised host, the absence of authentication (deliberate — the app
is designed to run behind an institutional auth proxy), and misconfiguration
already called out in docs/SECURITY.md.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Overview · KatherLab/deidentifier · GitHub
Skip to content
Security: KatherLab/deidentifier
Security

.github/SECURITY.md

Security Policy
Thanks for helping keep this project and its users safe. This document covers
how to report a vulnerability. For the security posture of the application
itself — threat model, data flow, deployment checklist — see
docs/SECURITY.md and the companion documents in
docs/.
⚠️Evaluation tool. This is an internal evaluation tool. It is not a
certified medical device, and its output does not establish legal
anonymization. The deploying institution is the data controller and is
responsible for its own security review, DPIA, and information-governance
sign-off before processing real patient data.
Supported versions
This is an actively developed research project. Only the latest release and
the main branch receive security fixes. Please upgrade before reporting, in
case the issue has already been addressed.
VersionSupported
Latest release✅
main✅
Older releases❌
Reporting a vulnerability
Please do not open a public GitHub issue for security vulnerabilities.
Report privately through either channel:
  1. GitHub Security Advisories (preferred) — use the
Report a vulnerability
button on the repository's Security tab. This keeps the report private and
lets us collaborate on a fix.
  2. Email — contact the maintainer at fabian.wolf2@tu-dresden.de with
the subject line [deidentifier security].
Please include, where possible:
  • a description of the vulnerability and its impact,
  • steps to reproduce (proof of concept, affected endpoint, configuration),
  • the version or commit hash and the deployment mode (detectors enabled, OCR
engine, Docker or local),
  • any suggested remediation.
🚫 Never attach a real clinical document. Reproduce with synthetic text —
backend/tests/files/ contains examples — and attach that instead.
Anonymization failures
A missed identifier is a known limitation, not a vulnerability: no detector
finds everything, which is why human review is part of the design. Report those
as normal issues (with synthetic reproduction), or better, quantify them with
the evaluation harness.
Do report as a security issue anything that makes the tool claim more than it
checked, for example:
  • a redacted PDF export whose blackout can be reversed or whose text remains
extractable,
  • document content appearing in logs or in an API response that should not
carry it,
  • a status of PASS while redacted content demonstrably remains in the output,
  • a path by which one user could reach another user's document or result.
What to expect
  • Acknowledgement: we aim to confirm receipt within 5 business days.
  • Assessment: we investigate and keep you updated on findings and planned
remediation.
  • Disclosure: we follow coordinated disclosure. Please allow a
reasonable window for a fix before public disclosure. We are happy to credit
reporters in the release notes unless you prefer to stay anonymous.
As a small research team we cannot offer a paid bug bounty, but we genuinely
appreciate responsible disclosure.
Scope
In scope: the FastAPI backend, the Vue frontend, the anonymization
pipeline, the redacted-PDF export, and the official Docker images.
Out of scope: vulnerabilities in third-party dependencies (report those
upstream; we track them via Dependabot and the security workflow), issues that
require a compromised host, the absence of authentication (deliberate — the app
is designed to run behind an institutional auth proxy), and misconfiguration
already called out in docs/SECURITY.md.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Overview · KatherLab/deidentifier · GitHub
Skip to content
Security: KatherLab/deidentifier
Security

.github/SECURITY.md

Security Policy
Thanks for helping keep this project and its users safe. This document covers
how to report a vulnerability. For the security posture of the application
itself — threat model, data flow, deployment checklist — see
docs/SECURITY.md and the companion documents in
docs/.
⚠️Evaluation tool. This is an internal evaluation tool. It is not a
certified medical device, and its output does not establish legal
anonymization. The deploying institution is the data controller and is
responsible for its own security review, DPIA, and information-governance
sign-off before processing real patient data.
Supported versions
This is an actively developed research project. Only the latest release and
the main branch receive security fixes. Please upgrade before reporting, in
case the issue has already been addressed.
VersionSupported
Latest release✅
main✅
Older releases❌
Reporting a vulnerability
Please do not open a public GitHub issue for security vulnerabilities.
Report privately through either channel:
  1. GitHub Security Advisories (preferred) — use the
Report a vulnerability
button on the repository's Security tab. This keeps the report private and
lets us collaborate on a fix.
  2. Email — contact the maintainer at fabian.wolf2@tu-dresden.de with
the subject line [deidentifier security].
Please include, where possible:
  • a description of the vulnerability and its impact,
  • steps to reproduce (proof of concept, affected endpoint, configuration),
  • the version or commit hash and the deployment mode (detectors enabled, OCR
engine, Docker or local),
  • any suggested remediation.
🚫 Never attach a real clinical document. Reproduce with synthetic text —
backend/tests/files/ contains examples — and attach that instead.
Anonymization failures
A missed identifier is a known limitation, not a vulnerability: no detector
finds everything, which is why human review is part of the design. Report those
as normal issues (with synthetic reproduction), or better, quantify them with
the evaluation harness.
Do report as a security issue anything that makes the tool claim more than it
checked, for example:
  • a redacted PDF export whose blackout can be reversed or whose text remains
extractable,
  • document content appearing in logs or in an API response that should not
carry it,
  • a status of PASS while redacted content demonstrably remains in the output,
  • a path by which one user could reach another user's document or result.
What to expect
  • Acknowledgement: we aim to confirm receipt within 5 business days.
  • Assessment: we investigate and keep you updated on findings and planned
remediation.
  • Disclosure: we follow coordinated disclosure. Please allow a
reasonable window for a fix before public disclosure. We are happy to credit
reporters in the release notes unless you prefer to stay anonymous.
As a small research team we cannot offer a paid bug bounty, but we genuinely
appreciate responsible disclosure.
Scope
In scope: the FastAPI backend, the Vue frontend, the anonymization
pipeline, the redacted-PDF export, and the official Docker images.
Out of scope: vulnerabilities in third-party dependencies (report those
upstream; we track them via Dependabot and the security workflow), issues that
require a compromised host, the absence of authentication (deliberate — the app
is designed to run behind an institutional auth proxy), and misconfiguration
already called out in docs/SECURITY.md.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
Overview · KatherLab/deidentifier · GitHub
Skip to content
Security: KatherLab/deidentifier
Security

.github/SECURITY.md

Security Policy
Thanks for helping keep this project and its users safe. This document covers
how to report a vulnerability. For the security posture of the application
itself — threat model, data flow, deployment checklist — see
docs/SECURITY.md and the companion documents in
docs/.
⚠️Evaluation tool. This is an internal evaluation tool. It is not a
certified medical device, and its output does not establish legal
anonymization. The deploying institution is the data controller and is
responsible for its own security review, DPIA, and information-governance
sign-off before processing real patient data.
Supported versions
This is an actively developed research project. Only the latest release and
the main branch receive security fixes. Please upgrade before reporting, in
case the issue has already been addressed.
VersionSupported
Latest release✅
main✅
Older releases❌
Reporting a vulnerability
Please do not open a public GitHub issue for security vulnerabilities.
Report privately through either channel:
  1. GitHub Security Advisories (preferred) — use the
Report a vulnerability
button on the repository's Security tab. This keeps the report private and
lets us collaborate on a fix.
  2. Email — contact the maintainer at fabian.wolf2@tu-dresden.de with
the subject line [deidentifier security].
Please include, where possible:
  • a description of the vulnerability and its impact,
  • steps to reproduce (proof of concept, affected endpoint, configuration),
  • the version or commit hash and the deployment mode (detectors enabled, OCR
engine, Docker or local),
  • any suggested remediation.
🚫 Never attach a real clinical document. Reproduce with synthetic text —
backend/tests/files/ contains examples — and attach that instead.
Anonymization failures
A missed identifier is a known limitation, not a vulnerability: no detector
finds everything, which is why human review is part of the design. Report those
as normal issues (with synthetic reproduction), or better, quantify them with
the evaluation harness.
Do report as a security issue anything that makes the tool claim more than it
checked, for example:
  • a redacted PDF export whose blackout can be reversed or whose text remains
extractable,
  • document content appearing in logs or in an API response that should not
carry it,
  • a status of PASS while redacted content demonstrably remains in the output,
  • a path by which one user could reach another user's document or result.
What to expect
  • Acknowledgement: we aim to confirm receipt within 5 business days.
  • Assessment: we investigate and keep you updated on findings and planned
remediation.
  • Disclosure: we follow coordinated disclosure. Please allow a
reasonable window for a fix before public disclosure. We are happy to credit
reporters in the release notes unless you prefer to stay anonymous.
As a small research team we cannot offer a paid bug bounty, but we genuinely
appreciate responsible disclosure.
Scope
In scope: the FastAPI backend, the Vue frontend, the anonymization
pipeline, the redacted-PDF export, and the official Docker images.
Out of scope: vulnerabilities in third-party dependencies (report those
upstream; we track them via Dependabot and the security workflow), issues that
require a compromised host, the absence of authentication (deliberate — the app
is designed to run behind an institutional auth proxy), and misconfiguration
already called out in docs/SECURITY.md.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Overview · KatherLab/deidentifier · GitHub
Skip to content
Security: KatherLab/deidentifier
Security

.github/SECURITY.md

Security Policy
Thanks for helping keep this project and its users safe. This document covers
how to report a vulnerability. For the security posture of the application
itself — threat model, data flow, deployment checklist — see
docs/SECURITY.md and the companion documents in
docs/.
⚠️Evaluation tool. This is an internal evaluation tool. It is not a
certified medical device, and its output does not establish legal
anonymization. The deploying institution is the data controller and is
responsible for its own security review, DPIA, and information-governance
sign-off before processing real patient data.
Supported versions
This is an actively developed research project. Only the latest release and
the main branch receive security fixes. Please upgrade before reporting, in
case the issue has already been addressed.
VersionSupported
Latest release✅
main✅
Older releases❌
Reporting a vulnerability
Please do not open a public GitHub issue for security vulnerabilities.
Report privately through either channel:
  1. GitHub Security Advisories (preferred) — use the
Report a vulnerability
button on the repository's Security tab. This keeps the report private and
lets us collaborate on a fix.
  2. Email — contact the maintainer at fabian.wolf2@tu-dresden.de with
the subject line [deidentifier security].
Please include, where possible:
  • a description of the vulnerability and its impact,
  • steps to reproduce (proof of concept, affected endpoint, configuration),
  • the version or commit hash and the deployment mode (detectors enabled, OCR
engine, Docker or local),
  • any suggested remediation.
🚫 Never attach a real clinical document. Reproduce with synthetic text —
backend/tests/files/ contains examples — and attach that instead.
Anonymization failures
A missed identifier is a known limitation, not a vulnerability: no detector
finds everything, which is why human review is part of the design. Report those
as normal issues (with synthetic reproduction), or better, quantify them with
the evaluation harness.
Do report as a security issue anything that makes the tool claim more than it
checked, for example:
  • a redacted PDF export whose blackout can be reversed or whose text remains
extractable,
  • document content appearing in logs or in an API response that should not
carry it,
  • a status of PASS while redacted content demonstrably remains in the output,
  • a path by which one user could reach another user's document or result.
What to expect
  • Acknowledgement: we aim to confirm receipt within 5 business days.
  • Assessment: we investigate and keep you updated on findings and planned
remediation.
  • Disclosure: we follow coordinated disclosure. Please allow a
reasonable window for a fix before public disclosure. We are happy to credit
reporters in the release notes unless you prefer to stay anonymous.
As a small research team we cannot offer a paid bug bounty, but we genuinely
appreciate responsible disclosure.
Scope
In scope: the FastAPI backend, the Vue frontend, the anonymization
pipeline, the redacted-PDF export, and the official Docker images.
Out of scope: vulnerabilities in third-party dependencies (report those
upstream; we track them via Dependabot and the security workflow), issues that
require a compromised host, the absence of authentication (deliberate — the app
is designed to run behind an institutional auth proxy), and misconfiguration
already called out in docs/SECURITY.md.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
})();
Overview · KatherLab/deidentifier · GitHub
Skip to content
Security: KatherLab/deidentifier
Security

.github/SECURITY.md

Security Policy
Thanks for helping keep this project and its users safe. This document covers
how to report a vulnerability. For the security posture of the application
itself — threat model, data flow, deployment checklist — see
docs/SECURITY.md and the companion documents in
docs/.
⚠️Evaluation tool. This is an internal evaluation tool. It is not a
certified medical device, and its output does not establish legal
anonymization. The deploying institution is the data controller and is
responsible for its own security review, DPIA, and information-governance
sign-off before processing real patient data.
Supported versions
This is an actively developed research project. Only the latest release and
the main branch receive security fixes. Please upgrade before reporting, in
case the issue has already been addressed.
VersionSupported
Latest release✅
main✅
Older releases❌
Reporting a vulnerability
Please do not open a public GitHub issue for security vulnerabilities.
Report privately through either channel:
  1. GitHub Security Advisories (preferred) — use the
Report a vulnerability
button on the repository's Security tab. This keeps the report private and
lets us collaborate on a fix.
  2. Email — contact the maintainer at fabian.wolf2@tu-dresden.de with
the subject line [deidentifier security].
Please include, where possible:
  • a description of the vulnerability and its impact,
  • steps to reproduce (proof of concept, affected endpoint, configuration),
  • the version or commit hash and the deployment mode (detectors enabled, OCR
engine, Docker or local),
  • any suggested remediation.
🚫 Never attach a real clinical document. Reproduce with synthetic text —
backend/tests/files/ contains examples — and attach that instead.
Anonymization failures
A missed identifier is a known limitation, not a vulnerability: no detector
finds everything, which is why human review is part of the design. Report those
as normal issues (with synthetic reproduction), or better, quantify them with
the evaluation harness.
Do report as a security issue anything that makes the tool claim more than it
checked, for example:
  • a redacted PDF export whose blackout can be reversed or whose text remains
extractable,
  • document content appearing in logs or in an API response that should not
carry it,
  • a status of PASS while redacted content demonstrably remains in the output,
  • a path by which one user could reach another user's document or result.
What to expect
  • Acknowledgement: we aim to confirm receipt within 5 business days.
  • Assessment: we investigate and keep you updated on findings and planned
remediation.
  • Disclosure: we follow coordinated disclosure. Please allow a
reasonable window for a fix before public disclosure. We are happy to credit
reporters in the release notes unless you prefer to stay anonymous.
As a small research team we cannot offer a paid bug bounty, but we genuinely
appreciate responsible disclosure.
Scope
In scope: the FastAPI backend, the Vue frontend, the anonymization
pipeline, the redacted-PDF export, and the official Docker images.
Out of scope: vulnerabilities in third-party dependencies (report those
upstream; we track them via Dependabot and the security workflow), issues that
require a compromised host, the absence of authentication (deliberate — the app
is designed to run behind an institutional auth proxy), and misconfiguration
already called out in docs/SECURITY.md.
 There aren't any published security advisories