This project has two kinds of security concern, and they are handled differently. Please read the right section.

A full analysis of what this project believes its risks are, what it does about each, and what it accepts, is in THREAT_MODEL.md.

Until 1.0, only the latest minor release receives fixes. After 1.0 the intent is to support the current and the previous minor release.

The attack surface is deliberately small, and every claim below is checked mechanically on every commit rather than asserted.

The realistic risk classes that remain are: a supply-chain compromise of the published artefact, a denial of service through pathological input to the search or path parser, and a vulnerability in a development-time tool. All three are analysed in THREAT_MODEL.md.

Do not open a public issue for a vulnerability.

Two channels, either is fine:

1. GitHub private vulnerability reporting, from the Security tab of the repository. Preferred, because it keeps the discussion attached to the project.
2. Email yunus.imanov@metropolia.fi.

Please include:

• a description of the issue and the class of vulnerability;
• the version affected, and the earliest version you know to be affected;
• steps to reproduce, or a proof of concept;
• the impact as you assess it, and any assumptions that assessment rests on;
• whether the issue is already public anywhere;
• how you would like to be credited, if at all.

If the issue looks like it may be exploitable, please describe the class of problem rather than sending a fully weaponised exploit.

Coordinated disclosure is preferred. Credit is given in CHANGELOG.md and AUTHORS.md unless you ask otherwise.

There is no bug bounty. This is an unfunded academic project with one maintainer. That is stated plainly so that nobody spends effort expecting one.

If you make a good-faith effort to comply with this policy during your research, we will consider your research authorised, we will work with you to understand and resolve the issue quickly, and we will not pursue or support legal action against you.

Good faith means: you avoid privacy violations, data destruction and service degradation; you only interact with systems you own or have permission to test; you give us reasonable time to respond before disclosing; and you do not exploit an issue beyond the minimum needed to demonstrate it.

This safe harbour covers this project. It cannot bind GitHub, PyPI, Read the Docs or any other third party.

This is a library about biotechnology, and one of its ten branches, dark, is explicitly about the harmful potential of the field: bioterrorism, biological weapons, and accidental release. That branch is not an oversight and it is not a gap in judgement. It is documented deliberately, and it is documented exclusively from the protective side.

Biosafety and containment. Biosecurity governance. Dual-use research oversight. Gene synthesis screening. Biosurveillance and early detection. Biodefence and medical countermeasures. Microbial forensics and attribution. Biological arms control and the Biological Weapons Convention.

Every one of these is defensive, institutional or diplomatic. They describe the apparatus by which societies keep biological research safe, from accident and from deliberate misuse, and they are the subjects of a large open literature, of United Nations treaty processes, and of university courses.

The following are out of scope in every facet of every record, in every branch of this taxonomy, regardless of stated intent:

• synthesis, acquisition or production routes for dangerous pathogens or toxins;
• methods to enhance transmissibility, virulence, environmental stability or host range;
• methods to defeat detection, screening, containment or medical countermeasures;
• weaponisation, formulation, stabilisation or dissemination information of any kind;
• target selection, vulnerability assessment of specific facilities or populations, or anything that reads as operational planning;
• quantities, thresholds or parameters whose only use is operational;
• any content that functions as a protocol rather than as a description of a governance problem.

• An automated dual-use screen runs as a pre-commit hook and in CI. It scans the full text of the dark branch and applies a narrower screen across the whole taxonomy, for operational framing.
• tests/test_dark_branch_is_defensive.py runs in the test suite.
• CODEOWNERS never delegates the dark branch, even after domain editors exist for the other nine.
• Every issue and pull request template carries a dual-use declaration.

The automated screen is a floor, not a ceiling. Maintainer judgement applies above it, and a contribution that passes the screen may still be rejected on review.

The maintainers will not negotiate about this. A stated purpose, meaning research, education, fiction or testing, does not change the outcome, because the published text is identical either way. This is the one area of the project explicitly exempted from consensus in GOVERNANCE.md section 3.4.

If you believe something in this repository crosses that line, in the dark branch or anywhere else, please report it privately to yunus.imanov@metropolia.fi rather than opening a public issue that quotes it.

Include the file path, the specific text, and why you assess it as operational rather than descriptive. Reports of this kind are treated with the same priority as a software vulnerability, and material judged to cross the line is removed first and discussed afterwards.

Removing it would not make anyone safer. The colour scheme this library documents includes dark as one of its ten branches; a taxonomy that silently omitted it would be an inaccurate description of how the field is taught and discussed.

More importantly, the subject matter of the branch, meaning containment standards, oversight of risky research, synthesis screening, treaty compliance, is exactly the material that policy staff, journalists and students need in order to understand and argue about biosecurity, and it is poorly served by existing accessible sources.

The choice made here is to cover the governance of the risk, thoroughly and in plain language, and to cover nothing else.

# Verify that a wheel came from this repository.
gh attestation verify biotechnology-0.1.0-py3-none-any.whl \
   --repo olaflaitinen/biotechnology

# Compare against the checksums recorded in the GitHub release notes.
sha256sum biotechnology-0.1.0-py3-none-any.whl

# Confirm the installed package pulled in nothing.
python -m venv /tmp/check
/tmp/check/bin/pip install biotechnology
/tmp/check/bin/pip list

The last command should list biotechnology and nothing else beyond pip, setuptools and wheel. If it lists anything more, something is wrong and we would like to hear about it.

• Every workflow declares a top-level permissions: {} and grants each job the minimum it needs. Checked in the security audit.
• Every checkout uses persist-credentials: false.
• pull_request_target is forbidden and its absence is checked on every run.
• Every action reference is governed by .github/action-pins.yml and checked in CI and pre-commit.
• actionlint and zizmor analyse the workflows themselves.
• OpenSSF Scorecard runs weekly and its result is published to the public dataset, so that a downstream consumer can query it without asking us.

This library is a reference work, not validated software.

It is not qualified under any medical device, in vitro diagnostic, clinical laboratory, GxP, or functional-safety framework, and must not be used as if it were. In particular:

• Metric ranges are orientation figures carrying an explicit evidence grade. They are not specifications and must never set a dose, a limit, a release criterion or a safety threshold.
• formulas modules implement published relationships for teaching and estimation. Verify against the primary source cited in each module's derivation.py before any decision depends on the result.
• Regulatory citations were accurate to the best of the author's knowledge at the data freeze date recorded in CHANGELOG.md. Law changes. Verify against the current official text.
• Nothing here is medical, veterinary, legal, regulatory, investment or biosafety advice.

See NOTICE.md section 6 for the full disclaimer, and THREAT_MODEL.md section 5 for the risks this project accepts rather than mitigates.

Machine-readable contact metadata is published at .well-known/security.txt.