The security surface area of Apache Hamilton should be pretty small in comparison to other projects.
We currently only support the latest version of Apache Hamilton that's been released.
| Version | Supported |
|---|---|
| Latest | ✅ |
Apache Hamilton executes user-authored Python functions in the host process. Dataflows, extensions, and adapters therefore run with the same privileges as the Python process and must come from trusted sources.
Hamilton also provides an explicit loader for Python pickle files. Pickle deserialization can execute
arbitrary code, so @load_from.pickle and PickleLoader must only be used with files from trusted
sources. When data crosses a trust boundary, use a non-executable interchange format such as JSON,
Parquet, or Arrow instead.
This is a project of the Apache Software Foundation and follows the ASF vulnerability handling process.
To report a new vulnerability you have discovered please follow the ASF vulnerability reporting process.