NewsScope is an academic final year project submitted at Technological University Dublin. While it is not a commercial product with a formal release cycle, the author takes security seriously and welcomes vulnerability reports from anyone reviewing the code.

This security policy covers the NewsScope codebase as submitted in April 2026, including:

• The FastAPI backend (backend/)
• The Flutter Android client (frontend/newsscope/)
• The three Hugging Face Spaces hosting the project's NLP models
• Continuous integration workflows (.github/workflows/)

It does not cover third-party services NewsScope depends on (Supabase, Firebase, Render, Hugging Face, NewsAPI, Google Fact Check Tools). Vulnerabilities in those services should be reported directly to their respective vendors.

If you discover a security issue in NewsScope, please report it privately rather than opening a public GitHub issue.

Email: christophernoblett47@gmail.com

Subject line: [SECURITY] NewsScope — <brief description>

Please include:

• A clear description of the vulnerability
• Steps to reproduce, ideally with a minimal proof of concept
• The affected component (backend route, Flutter screen, Space, etc.)
• Your assessment of the potential impact
• Whether you would like to be credited in any subsequent fix

I will acknowledge receipt within 72 hours and aim to provide an initial assessment within one week. Because this is a single-developer academic project, response times outside of those windows depend on coursework and exam schedules. Thank you for understanding.

The following are in scope and should be reported:

• Authentication or authorisation bypass on any backend endpoint
• Exposure of user data (reading history, email addresses, Firebase UIDs) to unauthorised parties
• SQL injection, prompt injection into LLM-facing components, or any injection vulnerability in the ingestion or analysis pipelines
• Insecure handling of API keys, tokens, or credentials
• Cross-site scripting in any rendered article content or fact-check links
• Server-side request forgery in the article scraping pipeline
• Denial of service vulnerabilities affecting the backend or any Hugging Face Space
• Bypass of the GDPR-compliant data deletion endpoints
• Weaknesses in Firebase JWT validation or session handling
• Insecure default configurations in .env.example, requirements.txt, or pubspec.yaml

The following are out of scope and will be acknowledged but not actioned:

• Issues requiring physical access to a user's unlocked device
• Self-XSS that requires the victim to paste attacker-supplied code into a developer console
• Vulnerabilities in third-party dependencies that have not been disclosed upstream (please report those to the dependency maintainer first)
• Reports generated by automated scanners without manual verification
• Theoretical issues without a demonstrated impact path
• Best-practice deviations that don't represent an actual security boundary (e.g. "this code could be more defensive")

When a valid vulnerability is reported, the process is:

1. Acknowledge within 72 hours
2. Triage and reproduce within one week
3. Develop and test a fix in a private branch
4. Deploy the fix to production (Render auto-deploy from main)
5. Publish a brief security note in the GitHub repository, crediting the reporter unless they request anonymity
6. Notify the project supervisor at TU Dublin if the issue affects the submitted dissertation in any material way

For critical vulnerabilities (active exploitation, exposure of credentials, or user data leakage), I will treat the issue as urgent and aim to deploy a fix within 24 hours of confirmation.

For transparency, the following are deliberate design decisions documented in the dissertation rather than vulnerabilities:

• Backend uses the Supabase service_role key to bypass Row Level Security. User-level data isolation is enforced at the application layer via Firebase JWT validation in the get_current_user dependency. RLS exists as defence in depth against direct anon-key access.
• The free-tier infrastructure does not include WAF or DDoS protection beyond what Render provides by default. This is acknowledged as a deployment limitation, not a code-level vulnerability.
• Article scraping makes outbound HTTP requests to news outlet domains. These are limited to a hard-coded allowlist of twelve sources defined in backend/app/jobs/ingestion.py. SSRF risk is bounded by the allowlist.
• LIME explainability calls the political bias Hugging Face Space remotely. The Space accepts text input from any caller; rate limiting is enforced by Hugging Face's free tier, not by NewsScope itself.

If you find a hard-coded credential or token anywhere in the repository or its history, please report it immediately as a security issue. The author has rotated all credentials before submission and uses Render environment variables, Supabase secrets, and Colab Secrets for runtime credentials. Any token visible in committed code is a bug.

Author: Christopher Noblett

Email: christophernoblett47@gmail.com

Institution: Technological University Dublin

Project Supervisor: Eoin Rogers