rustytorch/SECURITY.md

RustyTorch++ Security Guidelines

Overview

This document outlines security best practices for deploying and configuring RustyTorch++.

Secret Management

Environment Variables

Sensitive configuration should be provided via environment variables, NOT hardcoded in config files:

# Database credentials
export RTX_DATABASE__URL="postgres://user:password@host:5432/db"
export RTX_DATABASE__PASSWORD="<secure-password>"

# API keys
export RTX_HUB__API_KEY="<api-key>"
export RTX_AWS__SECRET_ACCESS_KEY="<aws-secret>"

# Authentication secrets
export RTX_AUTH__JWT_SECRET="<jwt-signing-key>"
export RTX_AUTH__SESSION_SECRET="<session-secret>"

Configuration File Security

When using configuration files:

1. Never commit secrets - Use .gitignore to exclude:

   • .env files
   • *.secret.toml files
   • credentials.json

2. Use placeholders - Reference environment variables:

   [database]
   url = "${RTX_DATABASE__URL}"
   password = "${RTX_DATABASE__PASSWORD}"
   

3. File permissions - Restrict config file access:

   chmod 600 /etc/rustytorch/config.toml
   chown rtx-user:rtx-group /etc/rustytorch/config.toml
   

Secret Rotation

1. API Keys: Rotate every 90 days minimum
2. Database Passwords: Rotate every 60 days
3. JWT Secrets: Rotate on security events or every 180 days
4. Session Secrets: Rotate on security events

Input Validation

RustyTorch++ includes comprehensive input validation in rtx-serving-api:

use rtx_serving_api::{InputValidator, ValidationConfig};

// Use default limits
let validator = InputValidator::default();

// Validate tensor inputs
validator.validate_tensor_shape(&[32, 128, 768])?;
validator.validate_batch_size(64)?;
validator.validate_inference_input(&data, &shape)?;

// Sanitize user input
let model_id = InputValidator::sanitize_model_id(user_input)?;

Default Limits

Parameter	Default	Restrictive	Permissive
Max Request Size	100MB	10MB	500MB
Max Tensor Dims	8	6	16
Max Tensor Elements	100M	10M	1B
Max Batch Size	256	64	1024
Max Sequence Length	128K	32K	1M
Max String Length	1MB	256KB	10MB

Network Security

TLS Configuration

Always use TLS in production:

[server]
tls_enabled = true
tls_cert_path = "/etc/ssl/certs/rtx.crt"
tls_key_path = "/etc/ssl/private/rtx.key"
min_tls_version = "1.2"

Network Isolation

1. Run inference servers in isolated network segments
2. Use firewall rules to restrict access
3. Implement rate limiting (built-in):

use rtx_serving_api::RateLimitManager;

let rate_limiter = RateLimitManager::new(config);

Dependency Security

Automated Scanning

Security scanning is integrated into CI/CD:

# .github/workflows/ci.yml
- name: Security audit
  uses: rustsec/audit-check@v2

Current Vulnerabilities

See SECURITY_AUDIT.md for current vulnerability status and remediation plans.

Dependency Updates

Run regular dependency updates:

# Check for updates
cargo outdated

# Run security audit
cargo audit

# Update dependencies
cargo update

Runtime Security

Circuit Breaker Pattern

Built-in resilience against cascading failures:

use rtx_serving_api::CircuitBreaker;

let breaker = CircuitBreaker::new(CircuitBreakerConfig {
    failure_threshold: 5,
    reset_timeout: Duration::from_secs(30),
    half_open_requests: 3,
});

Resource Limits

Configure resource limits in production:

[limits]
max_concurrent_requests = 1000
max_memory_mb = 32768
request_timeout_ms = 30000
max_queue_size = 10000

Audit Logging

Enable audit logging for security-sensitive operations:

[logging]
audit_enabled = true
audit_log_path = "/var/log/rustytorch/audit.log"
log_level = "info"

# Log these events
audit_events = [
    "model_load",
    "model_unload",
    "config_change",
    "auth_failure",
    "rate_limit_exceeded",
]

Container Security

When deploying in containers:

1. Use non-root user:

   USER rtx-user
   

2. Read-only filesystem:

   docker run --read-only ...
   

3. No new privileges:

   docker run --security-opt=no-new-privileges ...
   

4. Resource limits:

   docker run --memory=32g --cpus=8 ...
   

Reporting Security Issues

Please report security vulnerabilities to: [email protected]

Do NOT create public issues for security vulnerabilities.

Security Checklist

Before deploying to production:

• No hardcoded secrets in code or config files
• All secrets provided via environment variables or secret manager
• TLS enabled for all network communication
• Rate limiting configured
• Input validation enabled (default)
• Circuit breaker patterns enabled
• Audit logging enabled
• Dependencies audited (cargo audit passes)
• Container running as non-root user
• Resource limits configured
• Network isolation in place