src/docs/SECURITY.md

Security review of the serving code

When and how. 8 October 2026, a read-only review of the gateway: trace every untrusted input to every sink, confirm each candidate end to end, keep only findings with confidence 8 of 10 or more.

Scope. crates/diar-gateway, crates/diar-triton, crates/diar-audio (decoding untrusted uploads), the engine's input path, python/anuvani_diar/client.py, the Triton models, image and scripts, and the compose stack. Threat model: clients are untrusted; the gateway binds 127.0.0.1 by default but may be exposed; Triton listens on 127.0.0.1 only; the host may have other local accounts.

Findings and fixes

#	Finding	Severity	Fix	Test
1	The Python client sent its bearer token along any HTTP redirect (urllib copies every request header to the redirect target), so a forged 302 on an exposed, non-TLS deployment would hand the token to another host	medium	the client never follows redirects; a 3xx is an error (the gateway never redirects)	test_client_does_not_follow_redirects
2	The size limit and the memory budget were checked on the decoded audio only; resampling to 16 kHz came after, unchecked, so a file declaring a low sample rate (libsndfile accepts any) could grow up to 16,000 times past both, e.g. 2.4 MB at 1 Hz becoming 38.4 GB	medium	the resampled size, ceil(frames x 16000 / rate) samples, is computed from the header with the decoded one; both must be within --max-audio-gb, and the budget holds both	test_a_low_sample_rate_cannot_resample_past_the_limit (engine and gateway)
3	Grafana allowed anonymous viewing; on a host with other accounts the loopback is theirs too	low	anonymous access off; the admin password is generated into artifacts/compose/grafana_password (mode 0600)	configuration

Checked and found sound (from the review): the token middleware covers every route but /health, with a constant-time comparison; upload names, uris and spool files (no path separators, exclusive creation with mode 0600 in a directory refused unless it is ours and 0700); path jobs (canonical path under the allowed root, regular files only, one generic refusal message); no injection into RTTM lines or JSON through uri; Triton responses parsed with checked slicing only; the unsafe blocks in decoding and tensor encoding; panics contained per file (engine) or per request (axum); no token or server path in logs or error messages; every published port on 127.0.0.1, read-only mounts, no privileged containers.

What remains (by design or out of scope)

• libsndfile parses untrusted uploads inside the gateway process, as soundfile does inside the release. A parser bug in libsndfile 1.2.2 would take the gateway down. 2,750 damaged files decode exactly as soundfile does (tests/test_audio_decode.py), which is a check of equivalence, not of libsndfile's own safety. Decoding in a separate process would contain such a bug; not done.
• Without a token, any local account can use the gateway, and with --allow-path-root have it read files under that root with your account's rights. triton/README.md says to set a token on a shared machine.
• Path jobs: the file is opened by its canonical path after the check, so someone who can write inside the allowed root could swap a path component in between. That needs write access inside a root the operator chose.
• Jobs live in the gateway's memory: a gateway restart loses them; the Python client resubmits (tested), other clients must.

Second review: the FastAPI service (9 October 2026)

A read-only review of triton_inference/service (the FastAPI app, its settings, spool, Dockerfile and build script) and its Rust binding (crates/diar-py/src/service.rs), against the pinned libraries (fastapi 0.143.0, starlette 1.7.0, uvicorn 0.54.0, h11 0.16.0, python-multipart 0.0.32). Two findings were confirmed by offline measurement before they were fixed.

#	Finding	Severity	Fix	Test
4	The resampling filter was not counted. torchaudio's sinc filter for a rate sr is a (16000 / g, 2 x width + sr / g) table of float64, g = gcd(sr, 16000), whatever the file's length; a 500-byte WAV declaring 16,001 Hz asks for 2 GB per table (measured: +4.2 GB peak, 4.4 s), one declaring 1,000,003 Hz for about 128 GB. Item 2's limits saw only 400 bytes decoded and 8 bytes resampled. This reached the gateway and the pip package too (same engine)	high	the engine computes the filter's size from the header's rate (resample_filter_bytes, checked against torchaudio 2.1.1's own tables) and refuses a file whose filter exceeds 64 MiB before anything is resampled; every common rate (8 to 192 kHz) needs under 3 MB. A file the release would have resampled at such a rate is now refused: the one place where the engine's behaviour departs from the release's, for headers no recorder writes	test_a_rate_that_does_not_reduce_cannot_build_a_huge_resampling_filter (engine and service); resample_filter_sizes (Rust)
5	Multipart bodies were bounded only in their file part: parts with no data but distinct names of up to 4 KiB each were kept in a dict without limit, and with Transfer-Encoding: chunked (no Content-Length) nothing capped the non-file bytes (measured: memory grew 1:1 with the bytes sent)	high	at most 16 parts; boundaries, part headers, fields and anything after the closing boundary together within 128 KiB above --max-upload-mb, checked while streaming	test_multipart_framing_is_bounded
6	The image's default command listened on 0.0.0.0 and a token was optional, so docker run --network host without a token exposed the API on every interface	medium	--listen on an address other than the loopback refuses to start without a token, unless --insecure-no-token	test_listening_beyond_the_loopback_needs_a_token
7	An unusual spool OSError without strerror put the spool file's path into the error message	low	a generic message instead	review

Not changed, recorded:

• One token, one trust domain. Any holder of the token can read or cancel any job and replay any Idempotency-Key. Job ids are 128 random bits, and the result cache answers only for audio the caller sent, so nothing leaks between callers who know nothing of each other's jobs; but the service is single-tenant. Several tenants need a reverse proxy with per-tenant tokens in front, or per-token scoping (not done).
• Path jobs keep the gateway's check-then-open gap (above).
• Base images are pinned by tag (ubuntu:22.04, tritonserver:24.10-py3, tritonserver:25.06-py3), not by digest; /docs and /redoc load their JavaScript from cdn.jsdelivr.net (FastAPI's defaults), behind the token.

Tritons on other machines (10 October 2026)

diar up --tritons-only --bind ADDR publishes a machine's Tritons on ADDR so that another machine's service can use its GPUs (diar up --remote). Triton has no authentication: anyone who reaches those ports can run the networks and read the server's metadata. The Tritons start with --model-control-mode=none, so models can be neither loaded nor unloaded through the API, but the ports must stay on a private network: bind to a private address (the command refuses to publish without --bind), never to a public interface, and firewall the ports to the service's machine. The service's own token and limits are unchanged.