If you discover a security vulnerability in OpenLeaf, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please email: ramon.dalmau-codina@eurocontrol.int

Include:

• A description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

You should receive an acknowledgement within 72 hours. We will work with you to understand the issue and coordinate a fix before any public disclosure.

OpenLeaf is a scientific computing library for aircraft performance modeling. Security considerations include:

• File path handling: BADA data paths are configured via environment variables and settings files. OpenLeaf validates paths but does not sandbox file access.
• Dependency supply chain: We pin minimum versions for all dependencies, lock exact versions in uv.lock, and run a blocking pip-audit in CI to detect known vulnerabilities.
• Serialization: OpenLeaf does not use pickle or other unsafe deserialization. Model data is loaded from structured text/XML files with dedicated parsers.
• No network access: OpenLeaf does not make network requests at runtime. All data is loaded from local files.

• Keep dependencies up to date (uv sync --upgrade)
• Do not expose BADA data files in public repositories (they are proprietary)
• Use environment variables (e.g. OPENLEAF_BADA3_PATH) or the user-level settings file (~/.config/openleaf/settings.toml, outside any repository) for paths to licensed data; never commit such paths or data