We release patches for security vulnerabilities in the following versions:

This project employs multiple security tools to ensure code safety:

1. Gitleaks: Scans for secrets and sensitive information
2. Bandit: Python security linter for common vulnerabilities
3. Pre-commit hooks: Automated security checks before commits
4. Dependency scanning: Regular updates and vulnerability checks

# Install security tools
pip install bandit safety pip-audit

# Run Bandit for Python security issues
bandit -r . -ll

# Check for known vulnerabilities in dependencies
safety check
pip-audit

# Scan for secrets with Gitleaks
gitleaks detect --source . --verbose

# Install pre-commit
pip install pre-commit

# Install git hook scripts
pre-commit install

# Run against all files
pre-commit run --all-files

We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

1. Email: Send details to shailysharmawork@gmail.com
2. Subject Line: "Security Vulnerability - Eye Tracker Demo"
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Initial Response: Within 48 hours
• Status Update: Within 5 business days
• Resolution Timeline: Typically within 30 days for confirmed issues

• Please allow us reasonable time to address the issue before public disclosure
• We'll credit you in the security advisory (unless you prefer to remain anonymous)
• We don't offer monetary rewards but deeply appreciate your contribution to security

1. Never commit secrets: Use environment variables for sensitive data
2. Validate input: Always sanitize user input
3. Keep dependencies updated: Regularly update all packages
4. Use HTTPS: Never transmit sensitive data over HTTP
5. Follow OWASP guidelines: Implement security best practices

1. Use HTTPS: Always access the application via HTTPS
2. Camera permissions: Only grant camera access to trusted sites
3. Browser security: Keep your browser updated
4. Network security: Use the application on secure networks

• Client-side processing: No data leaves your browser
• No data storage: No personal information is collected or stored
• HTTPS enforced: SSL/TLS encryption in production
• Content Security Policy: Prevents XSS attacks
• Input validation: All user inputs are validated
• No authentication required: Reduces attack surface

• Camera access: Used only for eye tracking, no recording
• Local processing: All computations happen in your browser
• No analytics: No tracking cookies or analytics scripts
• No external requests: Except for loading WebGazer.js from CDN

In case of an active security incident:

1. Immediate: Disable affected features
2. Within 1 hour: Assess scope and impact
3. Within 4 hours: Deploy temporary fix if possible
4. Within 24 hours: Communicate with affected users
5. Follow-up: Full post-mortem and permanent fix

Security Team: Shaily Sharma
Email: shailysharmawork@gmail.com
Response Time: 24-48 hours

This security policy is adapted from best practices recommended by:

• GitHub Security Advisories
• OWASP Security Guidelines
• Industry standard responsible disclosure practices