Skip to content

Commit 4ec7518

Browse files
authored
Fix grammer in security.md (#3123)
* fix grammer * update grammer
1 parent 719526d commit 4ec7518

File tree

1 file changed

+12
-13
lines changed

1 file changed

+12
-13
lines changed

SECURITY.md

+12-13
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,9 @@
99

1010
## How we do security
1111

12-
TorchServe, as much as possible, relies on automated tools to do security scanning. In particular we support:
12+
13+
As much as possible, TorchServe relies on automated tools to do security scanning. In particular, we support:
14+
1315
1. Dependency Analysis: Using Dependabot
1416
2. Docker Scanning: Using Snyk
1517
3. Code Analysis: Using CodeQL
@@ -23,22 +25,22 @@ TorchServe, as much as possible, relies on automated tools to do security scanni
2325
These ports are accessible to `localhost` by default. The addresses can be configured by following the guides for
2426
[HTTP](https://github.com/pytorch/serve/blob/master/docs/configuration.md#configure-torchserve-listening-address-and-port) and
2527
[gRPC](https://github.com/pytorch/serve/blob/master/docs/configuration.md#configure-torchserve-grpc-listening-addresses-and-ports).
26-
TorchServe does not prevent users from configuring the address to be any value, including the wildcard address `0.0.0.0`.
28+
TorchServe does not prevent users from configuring the address to be of any value, including the wildcard address `0.0.0.0`.
2729
Please be aware of the security risks of configuring the address to be `0.0.0.0`, this will give all addresses(including publicly accessible addresses, if any)
28-
on the host, access to the TorchServer endpoints listening on the ports shown above.
29-
2. TorchServe's Docker image is configured to expose the ports `8080`, `8081`, `8082`, `7070`, `7071` to the host by [default](https://github.com/pytorch/serve/blob/master/docker/Dockerfile). When starting the container,
30-
make sure to map the ports exposed by the container to `localhost` ports or a specific IP address as shown in this [security guideline](https://github.com/pytorch/serve/blob/master/docker/README.md#security-guideline).
30+
on the host, access to the TorchServe endpoints listening on the ports shown above.
31+
2. By [default](https://github.com/pytorch/serve/blob/master/docker/Dockerfile), TorchServe's Docker image is configured to expose the ports `8080`, `8081`, `8082`, `7070`, `7071` to the host. When starting the container,
32+
map the ports exposed by the container to `localhost` ports or a specific IP address, as shown in this [security guideline](https://github.com/pytorch/serve/blob/master/docker/README.md#security-guideline).
3133

3234
3. Be sure to validate the authenticity of the `.mar` file being used with TorchServe.
3335
1. A `.mar` file being downloaded from the internet from an untrustworthy source may have malicious code, compromising the integrity of your application.
34-
2. TorchServe executes arbitrary python code packaged in the `mar` file. Make sure that you've either audited that the code you're using is safe and/or is from a source that you trust.
35-
3. Torchserve supports custom [plugins](https://github.com/pytorch/serve/tree/master/plugins) and [handlers](https://github.com/pytorch/serve/blob/master/docs/custom_service.md).
36+
2. TorchServe executes the arbitrary python code packaged in the `mar` file. Make sure that you've either audited that the code you're using is safe and/or is from a source that you trust.
37+
3. TorchServe supports custom [plugins](https://github.com/pytorch/serve/tree/master/plugins) and [handlers](https://github.com/pytorch/serve/blob/master/docs/custom_service.md).
3638
These can be utilized to extend TorchServe functionality to perform runtime security scanning using tools such as:
3739
- Clamd: https://pypi.org/project/clamd/
3840
- VirusTotal: https://virustotal.github.io/vt-py/
3941
- Fickling: https://github.com/trailofbits/fickling
40-
4. Running Torchserve inside a container environment and loading an untrusted `.mar` file does not guarantee isolation from a security perspective.
41-
4. By default TorchServe allows you to register models from all URLs. Make sure to set `allowed_urls` parameter in config.properties to restrict this. You can find more details in the [configuration guide](https://pytorch.org/serve/configuration.html#other-properties).
42+
4. Running TorchServe inside a container environment and loading an untrusted `.mar` file does not guarantee isolation from a security perspective.
43+
4. By default, TorchServe allows you to register models from all URLs. Make sure to set `allowed_urls` parameter in config.properties to restrict this. You can find more details in the [configuration guide](https://pytorch.org/serve/configuration.html#other-properties).
4244
- `use_env_allowed_urls=true` is required in config.properties to read `allowed_urls` from environment variable.
4345
5. Enable SSL:
4446

@@ -57,9 +59,6 @@ TorchServe, as much as possible, relies on automated tools to do security scanni
5759
7. If you intend to run multiple models in parallel with shared memory, it is your responsibility to ensure the models do not interact or access each other's data. The primary areas of concern are tenant isolation, resource allocation, model sharing and hardware attacks.
5860
8. TorchServe supports token authorization: check [documentation](https://github.com/pytorch/serve/blob/master/docs/token_authorization_api.md) for more information.
5961

60-
61-
62-
6362
## Reporting a Vulnerability
6463

65-
If you find a serious vulnerability please report it to https://www.facebook.com/whitehat and [email protected]
64+
If you find a strike vulnerability please report it to https://www.facebook.com/whitehat and [email protected]

0 commit comments

Comments
 (0)