Skip to content

Security: basenai/fineprint

SECURITY.md

Security Model

FinePrint is a stateless document-analysis service. This file describes what it does and does not do, and the controls in place.

What FinePrint never does

  • No key custody. FinePrint holds no private keys, cannot sign or broadcast transactions, and cannot move funds. The x402 paid tier only verifies payments via the configured facilitator; settlement happens entirely outside this service.
  • No document persistence. Scanned documents are processed in memory. Results are cached for 24 h (TTL) for calendar export, then evicted. Nothing is written to disk or a database.
  • No accounts, no PII collection. The service has no signup and stores no user identity.

Controls

Threat Control
SSRF via URL scanning http(s)-only, DNS resolution checked against private/loopback/link-local ranges, 1 MB body cap, 15 s timeout
Resource exhaustion 600 kb JSON body cap, 120k-char document cap, per-IP rate limit (10 scans / 15 min) on free endpoints
LLM hallucination Every LLM finding is string-match verified against the source document (punctuation/whitespace-normalized); unverifiable findings are dropped and counted publicly at /stats
Prompt injection via scanned documents The LLM output is constrained to a JSON schema, parsed defensively, and only used for findings whose quotes verify against the document; injected instructions cannot add fabricated clauses or reach any tool/side effect (the analyzer has none)
Paid-tier bypass Fail-closed: /x402/* performs no work unless the facilitator confirms payment; missing facilitator config keeps the paid tier closed, never open
XSS in playground All rendered fields pass through an HTML-escape helper; CSP restricts scripts to self
Clickjacking / sniffing helmet defaults (frameguard, nosniff, HSTS on HTTPS)

Out of scope / known limitations

  • FinePrint is a reading aid, not legal advice; findings are pattern- and LLM-derived and may be incomplete.
  • Free LLM tiers can rate-limit; the service degrades to the deterministic pattern engine and marks results engine.degraded = true rather than failing.

Reporting

Open a GitHub issue with the security label (or email the maintainer) — please do not include sensitive documents in reports.

There aren't any published security advisories