We take security seriously. If you discover a security vulnerability, please follow these steps:

1. DO NOT create a public GitHub issue
2. Email security report to: [email protected]
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Initial Response: Within 48 hours
• Status Update: Within 5 business days
• Resolution Target: 30 days for critical, 90 days for low severity

1. Secrets Management

   • Never commit credentials to git
   • Use environment variables for sensitive data
   • Rotate credentials regularly

2. Device Security

   • Use secure connections (USB debugging, SSH keys)
   • Limit device access to authorized users
   • Keep Android Debug Bridge (ADB) updated

3. Model Security

   • Verify model sources
   • Check model checksums
   • Don't use untrusted models

1. Code Security

   • Sanitize all inputs
   • Use parameterized commands
   • Avoid shell injection vulnerabilities
   • No hardcoded credentials

2. Dependencies

   • Keep dependencies updated
   • Review dependency licenses
   • Monitor for CVEs

3. CI/CD Security

   • Use secrets management
   • Limit runner permissions
   • Review workflow changes

• ADB runs with elevated privileges
• Ensure devices are trusted
• Use ADB authorization

• Use key-based authentication
• Verify host keys
• Limit SSH access scope

• Models run with benchmark_app privileges
• Potential for malicious models
• Validate model sources

• Input validation in configuration
• Parameterized shell commands
• Secrets excluded from logs

• Model signature verification
• Encrypted credential storage
• Audit logging

After a security issue is resolved:

1. Security advisory will be published
2. CVE will be requested if applicable
3. Users will be notified via GitHub

Security Team: [email protected] PGP Key: [Link to public key]

We appreciate responsible disclosure and will acknowledge security researchers who:

• Follow responsible disclosure practices
• Allow reasonable time for fixes
• Don't exploit vulnerabilities

Thank you for helping keep OVMobileBench secure!