# Security Considerations for AI-Berkshire: Protecting Financial Data and API Credentials

> Explore AI-Berkshire security considerations for protecting financial data and API credentials. Learn how its defense-in-depth model safeguards your information.

- Repository: [Xbt Lin/ai-berkshire](https://github.com/xbtlin/ai-berkshire)
- Tags: security
- Published: 2026-07-08

---

**AI-Berkshire implements a defense-in-depth security model that protects API credentials through environment variables, prevents prompt injection via input sanitization, and isolates filesystem operations to the repository directory, though users must manually configure secrets and validate data licenses.**

AI-Berkshire is an open-source research platform that combines financial data scraping, quantitative back-testing, and AI-driven report generation. Because it processes sensitive market data and interacts with external APIs like Xueqiu and Morningstar, understanding the **security considerations for ai-berkshire** is essential for safe deployment. The repository follows a minimalist security posture typical of research projects, emphasizing credential isolation, dependency pinning, and private vulnerability disclosure.

## API Key and Credential Management

The repository **does not ship with any hardcoded secrets**. All API keys for financial data providers must be supplied at runtime via environment variables or a private `.env` file excluded by `.gitignore`.

In [`tools/xueqiu_scraper.py`](https://github.com/xbtlin/ai-berkshire/blob/main/tools/xueqiu_scraper.py), the code retrieves the Xueqiu API key using `os.getenv()`:

```python
import os
from pathlib import Path

API_KEY = os.getenv("XUEQIU_API_KEY")
if not API_KEY:
    raise RuntimeError("XUEQIU_API_KEY not set – set it in a .env file or the environment")

```

This pattern ensures that sensitive credentials never appear in source control. The [`SECURITY.md`](https://github.com/xbtlin/ai-berkshire/blob/main/SECURITY.md) file explicitly directs reporters to disclose vulnerabilities privately, preventing accidental exposure of security flaws in public issues.

## Preventing Prompt Injection in AI Agents

The AI-driven agents defined in `skills/*.md` accept free-form user prompts, creating a potential **prompt injection** attack surface. Malicious prompts could attempt to extract internal logic, execute unintended commands, or bypass safety controls.

According to the source code, the repository addresses this by treating all user-generated text as data only—no shell execution is performed based on AI outputs. The [`CONTRIBUTING.md`](https://github.com/xbtlin/ai-berkshire/blob/main/CONTRIBUTING.md) documentation warns contributors not to open public issues for prompt-injection bugs, instead directing them to the private disclosure process outlined in [`SECURITY.md`](https://github.com/xbtlin/ai-berkshire/blob/main/SECURITY.md).

## Dependency Safety and Supply Chain Risks

Python scripts across the `tools/` directory import third-party libraries including `pandas`, `numpy`, and `requests`. To mitigate supply chain risks, the repository pins dependency versions in [`requirements.txt`](https://github.com/xbtlin/ai-berkshire/blob/main/requirements.txt) where present.

For example, [`tools/morningstar_fair_value.py`](https://github.com/xbtlin/ai-berkshire/blob/main/tools/morningstar_fair_value.py) uses explicit dtype specifications when parsing CSV files:

```python
import pandas as pd

def load_fair_value(csv_path: str) -> pd.DataFrame:
    # Enforce column types and disallow arbitrary parsing options

    dtype_map = {
        "ticker": str,
        "fair_value": float,
        "date": str,
    }
    return pd.read_csv(csv_path, dtype=dtype_map, parse_dates=["date"])

```

Explicit dtype mapping prevents maliciously crafted CSV rows from being interpreted as Python objects or code. Contributors should run `pip list --outdated` regularly and upgrade vulnerable packages to maintain security.

## Data Privacy and Licensing Compliance

The platform ingests market data from public sources into `data/*.json` and `data/*.csv` files. While these datasets support quantitative analysis, redistribution of proprietary market data may violate terms of service.

The [`README.md`](https://github.com/xbtlin/ai-berkshire/blob/main/README.md) emphasizes that the repository is intended for **research only**. All shipped data files are either publicly licensed or derived from open APIs, ensuring compliance with data provider agreements. Users must verify licensing terms before redistributing any downloaded financial datasets.

## Filesystem Isolation and Safe Logging

Helper scripts like [`tools/log-command.sh`](https://github.com/xbtlin/ai-berkshire/blob/main/tools/log-command.sh) write operational logs locally, requiring careful filesystem isolation to prevent unauthorized writes outside the repository.

The bash script confines output to the `logs/` directory:

```bash
#!/usr/bin/env bash

# Log command output safely inside the repository

LOG_DIR="$(dirname "$0")/../logs"
mkdir -p "$LOG_DIR"
exec >>"$LOG_DIR/$(date +%Y%m%d_%H%M%S).log" 2>&1
"$@"

```

This pattern ensures that log files remain within the repository boundary and never write to absolute system paths. The `.gitignore` file prevents accidental commits of log files, keeping the repository clean and preventing potential information leakage.

## Vulnerability Disclosure Process

AI-Berkshire maintains a structured security reporting workflow through [`SECURITY.md`](https://github.com/xbtlin/ai-berkshire/blob/main/SECURITY.md). The policy mandates **private disclosure** for all security vulnerabilities, requiring reporters to contact maintainers directly rather than opening public issues.

This approach prevents attackers from exploiting known vulnerabilities before patches are available. The [`CONTRIBUTING.md`](https://github.com/xbtlin/ai-berkshire/blob/main/CONTRIBUTING.md) guidelines reinforce this by explicitly warning contributors not to file public bug reports for security-related issues, including prompt injection vulnerabilities in AI agents.

## Summary

- **Credential Isolation**: API keys must be configured via environment variables or `.env` files, with no secrets hardcoded in the repository.
- **Input Validation**: CSV parsers in [`tools/morningstar_fair_value.py`](https://github.com/xbtlin/ai-berkshire/blob/main/tools/morningstar_fair_value.py) use explicit dtype specifications to prevent injection attacks.
- **Private Disclosure**: Security vulnerabilities must be reported privately through the process defined in [`SECURITY.md`](https://github.com/xbtlin/ai-berkshire/blob/main/SECURITY.md), not via public issues.
- **Filesystem Confinement**: Logging scripts restrict output to the `logs/` folder, preventing writes to system directories.
- **Dependency Management**: Third-party libraries should be pinned and regularly updated to mitigate supply chain risks.

## Frequently Asked Questions

### How should I store API keys when using AI-Berkshire?

Store API keys in environment variables or a private `.env` file that is excluded by `.gitignore`. The repository follows the pattern shown in [`tools/xueqiu_scraper.py`](https://github.com/xbtlin/ai-berkshire/blob/main/tools/xueqiu_scraper.py), which retrieves the `XUEQIU_API_KEY` environment variable and raises a runtime error if the credential is missing. Never commit API keys to source control.

### What is the risk of prompt injection in AI-Berkshire?

The AI agents in `skills/*.md` process user-supplied prompts, creating a risk that maliciously crafted inputs could extract internal logic or manipulate outputs. The codebase mitigates this by treating all user-generated text as data only—no shell execution is performed based on AI outputs. Report suspected prompt injection vulnerabilities privately via [`SECURITY.md`](https://github.com/xbtlin/ai-berkshire/blob/main/SECURITY.md).

### Does AI-Berkshire automatically update dependencies?

No, the repository does not automatically update dependencies. Users should manually review [`requirements.txt`](https://github.com/xbtlin/ai-berkshire/blob/main/requirements.txt) and run `pip list --outdated` to identify vulnerable packages. The Python tools use explicit dtype specifications when parsing data to minimize risks from malicious inputs, but keeping dependencies current is the user's responsibility.

### Where should I report security vulnerabilities?

Report security vulnerabilities privately following the disclosure process in [`SECURITY.md`](https://github.com/xbtlin/ai-berkshire/blob/main/SECURITY.md). Do not open public GitHub issues for security bugs, as this could expose the vulnerability to attackers before a patch is available. The [`CONTRIBUTING.md`](https://github.com/xbtlin/ai-berkshire/blob/main/CONTRIBUTING.md) guidelines explicitly prohibit public reporting of security-related issues.