Security
If you find a security hole, please let us know at security@sciencebo.uk. We try to respond (with fixes!) as soon as possible, and really appreciate the…
Reporting Vulnerabilities
If you find a security hole, please let us know at security@sciencebo.uk. We try to respond (with fixes!) as soon as possible, and really appreciate the help. Do not open a public issue, discuss it in comments, or post it on social media before we've had a chance to fix it. Responsible disclosure protects everyone.
Scope
In-scope: llms.sciencebo.uk and its API endpoints (/api/*). This includes XSS, CSRF, injection, authentication bypass, rate limit bypass, data exposure, and server-side vulnerabilities. Out-of-scope: third-party services (Google Fonts, favicon API), denial of service attacks, social engineering, and issues that require physical access.
What We Protect
Server-side data: votes (data/votes.json), comments (data/comments.json), submissions (data/submissions.json), reports (data/reports.json), and rejections (data/rejections.json). Client-side: localStorage contains user preferences, voted item IDs, saves, and dashboard state. No passwords, tokens, or personal data are stored. IP addresses are used for rate limiting and behaviour scoring only. They are stored in server memory (not persisted) and in report/comment records (not exposed via API).
Security Architecture
Rate limiting: per-IP behaviour engine with trust scoring (0-100), escalating cooldowns (30s to 1hr), and pattern detection (burst, monotone, duplicate content). Input validation: all user inputs are length-capped, type-validated against config, and quality-checked before persistence. URL normalization: bulletproof dedup handles encoded paths, port tricks, credential injection, double slashes, tracking params, and site-specific patterns (arxiv, GitHub, Reddit, HuggingFace). File writes: atomic (temp file + rename) to prevent corruption on crash. Body size: 100KB limit on all POST requests. No eval, no v-html, no dynamic SQL, no shell execution of user input.
Responsible Disclosure Hall of Fame
Thanks to the following people who have discovered and responsibly disclosed security issues in LLM Atlas: (No reports yet. Be the first! Email security@sciencebo.uk.) We credit all valid reports here with the date, your name, and a description of the finding.