This document outlines security best practices and known considerations for this research repository.

• ✅ Docker containerization isolates dependencies
• ✅ Reproducible environments across machines
• ✅ docker-compose for multi-service orchestration

• ✅ Pinned versions in requirements.txt
• ✅ Known package versions prevent drift
• ✅ Scientific packages (PyTorch, PennyLane) are well-maintained

• ✅ Data files are JSON (structured, safe parsing)
• ✅ No dynamic code execution from user input
• ✅ Notebooks are static-first (not runtime-configured)

Severity: Medium

Current Issue:

RUN pip install --no-cache-dir ...
# No USER directive - runs as root

Fix:

RUN useradd -m -u 1000 jupyter
USER jupyter

Why: Prevents container escape/privilege escalation.

Severity: Medium

Current Issue:

FROM python:3.11-slim

Fix:

FROM python:3.11-slim@sha256:a3ab0b966bc4e91546a033e22093cb840908979487a9fc0e6e38295747e49ac0

Why: Ensures reproducible builds, prevents image drift attacks.

Severity: Low

Current Issue:

version: '3'

Fix:

# Remove version line (no longer needed for compose v2+)
services:
  jupyter:
    image: ...

Why: Simplifies maintenance, aligns with Docker Compose v2+ standards.

Severity: Low

Current Issue: No .dockerignore file reduces build context clarity.

Fix: Create .dockerignore:

*.git
*.env
*.pem
*.key
__pycache__
.jupyter
.vscode
.idea
*.pyc
*.egg-info

Why: Reduces image size, prevents accidental secret inclusion.

Severity: Medium

Current Issue: No .gitignore could allow accidental commits of:

• Secrets (API keys, credentials)
• IDE files
• Virtual environments

Fix: Create .gitignore:

__pycache__/
.ipynb_checkpoints/
.env
.env.local
.vscode/
.idea/
venv/
*.pyc
*.pem
*.key
secrets/

Why: Prevents credential leaks to public repositories.

Severity: High

Current Issue: Cannot easily reproduce environment locally.

Fix: Create requirements.txt with pinned versions:

jupyter==1.1.1
jupyterlab==4.5.7
torch==2.12.0
pennylane==0.45.0
numpy==2.4.6
matplotlib==3.10.9
scipy==1.17.1
pandas==3.0.3
seaborn==0.13.2
statsmodels==0.14.6

Why: Reproducibility + security (no automatic updates).

Severity: Low

Current Issue (docker-compose.yml):

ports:
  - "0.0.0.0:8888:8888"

Fix:

ports:
  - "127.0.0.1:8888:8888"  # Local only

Why: Prevents external access (security by default). For remote access, use SSH tunneling.

Severity: Low

Current Issue: No memory/CPU limits in docker-compose.

Fix:

services:
  jupyter:
    deploy:
      resources:
        limits:
          cpus: '4'
          memory: 8G
        reservations:
          cpus: '2'
          memory: 4G

Why: Prevents resource exhaustion on shared systems.

Severity: Medium

Current Issue: Jupyter notebooks can execute arbitrary code.

Fix for production:

• Use nbconvert to validate before execution
• Run with --NotebookApp.allow_origin='127.0.0.1'
• Consider nbstripout for git to remove execution state

Why: Prevents malicious notebook cells from auto-executing.

Severity: Low

Fix (docker-compose.yml):

healthcheck:
  test: ["CMD", "curl", "-f", "http://localhost:8888/lab"]
  interval: 30s
  timeout: 10s
  retries: 3
  start_period: 40s

Why: Monitors container health automatically.

Create .github/CODEOWNERS:

* @moth-quantum

• Require PR reviews
• Require status checks
• Dismiss stale PRs

# Use git-secrets or detect-secrets
git secrets --scan

# Use trivy or snyk for vulnerability scanning
trivy image fourier-locking:latest

# Check for known vulnerabilities
pip-audit

• Add CC-BY-4.0 LICENSE file
• Create README with citations
• Pin all dependencies in requirements.txt
• Add .gitignore for secrets/environments
• Add .dockerignore for build context
• Fix Dockerfile (non-root user, SHA pin)
• Update docker-compose.yml (remove version, add health checks, limit ports)
• Run pip-audit for vulnerabilities
• Run trivy on Docker image
• Verify no secrets in git history: git log -p | grep -i "api\|key\|secret"
• Test local pip install: pip install -r requirements.txt
• Test Docker build: docker compose build
• Document any known limitations

1. ✅ Use immutable base images (SHA-pinned)
2. ✅ Run as non-root user
3. ✅ Set resource limits
4. ✅ Disable unnecessary services
5. ✅ Use minimal base images (alpine/slim)

1. ✅ Automated security scanning
2. ✅ Dependency version updates (Dependabot)
3. ✅ Linting & formatting checks
4. ✅ Unit test coverage

• OWASP Container Security
• Docker Best Practices
• PEP 668 - Python Virtual Environments
• NIST Container Security

Last Updated: 2026-07-10
Status: Review Required