Cybersecurity in UCSC genome browser mirror

[Vasundhara Anbalagan]

Hi Team, 

We are performing audit for the Regeneron UCSC Genome Browser (RUGB) and for the same, we need clarification for the below cybersecurity related questions at application level:

• Are persistent cookies or cookies that store credentials in plaintext used?
• Is there an application management process used to regularly update the solution's code to remediate security vulnerabilities?
• Do the application uses API?

It would be great if we were provided with answers for the same. Do let me know in case of any questions. 

Regards,

Vasundhara A

 

Regeneron - Internal

********************************************************************
This e-mail and any attachment hereto, is intended only for use by the addressee(s) named above and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, any dissemination, distribution or copying of this email, or any attachment hereto, is strictly prohibited. If you receive this email in error please immediately notify me by return electronic mail and permanently delete this email and any attachment hereto, any copy of this e-mail and of any such attachment, and any printout thereof. Finally, please note that only authorized representatives of Regeneron Pharmaceuticals, Inc. have the power and authority to enter into business dealings with any third party.
********************************************************************

[Matthew Speir]

Hello, Vasundhara.

Thank you for your questions.

Are persistent cookies or cookies that store credentials in plaintext used?

While we do use persistent cookies, they do not store credentials in plaintext.

Is there an application management process used to regularly update the solution's code to remediate security vulnerabilities?

One of our engineers shares: UCSC IT regularly scans all UCSC websites, including ours, and have occasionally found little bugs like HTML/JS injection that we have then addressed in our code. We have code that defends against SQL injection queries and use a nonce in script tags to make sure that Javascript that is added to the page later can't execute.

Is this what you're referring to? If not, please provide more details to clarify your question.

Do the application uses API?

Can you be more specific about what you mean by "API" in this context? Are you asking about external website's APIs, or if our web pages send AJAX requests to our servers, or something else?

If you have any further questions, please reply to gen...@soe.ucsc.edu. All messages sent to that address are archived on a publicly-accessible Google Groups forum. If your question includes sensitive data, you may send it instead to genom...@soe.ucsc.edu.

---

Matthew Speir

UCSC Genome Browser, User Support

--

---
You received this message because you are subscribed to the Google Groups "UCSC Genome Browser Public Support" group.
To unsubscribe from this group and stop receiving emails from it, send an email to genome+un...@soe.ucsc.edu.
To view this discussion visit https://groups.google.com/a/soe.ucsc.edu/d/msgid/genome/DS0PR20MB653683C8FC20C8FDD53DE6119ED8A%40DS0PR20MB6536.namprd20.prod.outlook.com.

[Vasundhara Anbalagan]

Hi Matthew, 

Thanks for the updates. 

Regarding API, I want to know do the mirror uses API, if so does it use HTTP Basic Authentication or OAuth v1 for authenticating users or applications?

In addition to this, we would also like to check if tileDB and genomicsDB  utilities are used in UCSC Genome Browser mirror if not, what are the possibilities of integrating the same. 

It would be great if we were provided with answers for the same. Do let me know in case of any questions. 

Regards,

Vasundhara A

---

From: Matthew Speir <msp...@ucsc.edu>
Sent: Monday, December 8, 2025 2:56 AM
To: Vasundhara Anbalagan <vasundhara...@regeneron.com>
Cc: Hiram Clawson <hi...@soe.ucsc.edu>; Maximilian Haeussler <mhae...@ucsc.edu>; Clay Fischer <clayf...@ucsc.edu>; gen...@soe.ucsc.edu <gen...@soe.ucsc.edu>; DL HPCOps <HPC-Ope...@regeneron.com>
Subject: [External] Re: [genome] Cybersecurity in UCSC genome browser mirror

Regeneron - Internal

[Maximilian Haeussler]

> Just a follow up! Regarding API, I want to know do the mirror uses API, if so does it use HTTP Basic Authentication or OAuth v1 

> for authenticating users or applications? For what process and all APIs are used and how they are managed.

The API does not authenticate users. It only has public data access functions. 

> In addition to this, we would also like to check if tileDB and genomicsDB  utilities are used in UCSC Genome Browser 

> mirror if not, what are the possibilities of integrating the same. 

No. We don't use these file formats. We can look into a converter, but these formats are not ideal for interactive visualisations that we produce. It would be great if you could put us in touch with the user who requested these, as it would be good to get some context, because the fact that this is coming up suggests to me that someone doesn't know our "track hub" feature.

best

Max

[Vasundhara Anbalagan]

Hi Matthew, 

Thanks for the updates. 

Just a follow up! Regarding API, I want to know do the mirror uses API, if so does it use HTTP Basic Authentication or OAuth v1 for authenticating users or applications? For what process and all APIs are used and how they are managed. 

In addition to this, we would also like to check if tileDB and genomicsDB  utilities are used in UCSC Genome Browser mirror if not, what are the possibilities of integrating the same. 

It would be great if we were provided with answers for the same. Do let me know in case of any questions. 

Regards,

Vasundhara A

---

From: Vasundhara Anbalagan <vasundhara...@regeneron.com>
Sent: Tuesday, December 9, 2025 3:43 AM
To: Matthew Speir <msp...@ucsc.edu>

Cc: Hiram Clawson <hi...@soe.ucsc.edu>; Maximilian Haeussler <mhae...@ucsc.edu>; Clay Fischer <clayf...@ucsc.edu>; gen...@soe.ucsc.edu <gen...@soe.ucsc.edu>; DL HPCOps <HPC-Ope...@regeneron.com>

Subject: Re: [External] Re: [genome] Cybersecurity in UCSC genome browser mirror

Regeneron - Internal

[Hiram Clawson]

Please clarify what you mean by: 'uses an API' - what 'API' are you
referring to ? The system itself does have an API that can be used
to extract data from the system, and there are functions in the browser
that use this API to obtain data for display. There is no authentication
required to use the API that is in the system, it is open for anyone to use.

As for tileDB and genomicsDB, those are analysis tools, not display
systems. For example,
a researcher might use GenomicsDB for variant analysis pipelines and
they could generate bigBed files to display results in the browser.
For the function of TileDB of random access to data, we use the
big* format files for that purpose. Perhaps the users that asked
for this function are unaware of the track hub functions to display
data in the genome browser.

--Hiram

On 12/15/25 9:27 AM, Vasundhara Anbalagan wrote:
> Hi Matthew,
>
> Thanks for the updates.
>

> Just a follow up! Regarding API, I want to know if the mirror uses API. If so, does it use HTTP Basic Authentication or OAuth v1 for authenticating users or applications? For what process and all APIs are used and how they are managed.

> In addition to this, we would also like to check if tileDB and genomicsDB utilities are used in UCSC Genome Browser mirror if not, what are the possibilities of integrating the same.
> It would be great if we were provided with answers for the same. Do let me know in case of any questions.
> Regards,
> Vasundhara A
> ________________________________
> From: Vasundhara Anbalagan <vasundhara...@regeneron.com>

> Sent: Thursday, December 11, 2025 8:46 PM

> If you have any further questions, please reply to gen...@soe.ucsc.edu<mailto:gen...@soe.ucsc.edu>. All messages sent to that address are archived on a publicly-accessible Google Groups forum. If your question includes sensitive data, you may send it instead to genom...@soe.ucsc.edu<mailto:genom...@soe.ucsc.edu>.

>
>
> ---
>
> Matthew Speir
>
> UCSC Genome Browser, User Support
>

> On Tue, Dec 2, 2025 at 11:40 AM 'Vasundhara Anbalagan' via UCSC Genome Browser Public Support <gen...@soe.ucsc.edu<mailto:gen...@soe.ucsc.edu>> wrote:
> Hi Team,
>
> We are performing audit for the Regeneron UCSC Genome Browser (RUGB) and for the same, we need clarification for the below cybersecurity related questions at application level:
>

> *

> Are persistent cookies or cookies that store credentials in plaintext used?

> *

> Is there an application management process used to regularly update the solution's code to remediate security vulnerabilities?

> *

> Do the application uses API?
>
> It would be great if we were provided with answers for the same. Do let me know in case of any questions.
> Regards,
> Vasundhara A
>
>
> Regeneron - Internal
> ********************************************************************
> This e-mail and any attachment hereto, is intended only for use by the addressee(s) named above and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, any dissemination, distribution or copying of this email, or any attachment hereto, is strictly prohibited. If you receive this email in error please immediately notify me by return electronic mail and permanently delete this email and any attachment hereto, any copy of this e-mail and of any such attachment, and any printout thereof. Finally, please note that only authorized representatives of Regeneron Pharmaceuticals, Inc. have the power and authority to enter into business dealings with any third party.
> ********************************************************************
> --
>
> ---
> You received this message because you are subscribed to the Google Groups "UCSC Genome Browser Public Support" group.

> To unsubscribe from this group and stop receiving emails from it, send an email to genome+un...@soe.ucsc.edu<mailto:genome+un...@soe.ucsc.edu>.
> To view this discussion visit https://groups.google.com/a/soe.ucsc.edu/d/msgid/genome/DS0PR20MB653683C8FC20C8FDD53DE6119ED8A%40DS0PR20MB6536.namprd20.prod.outlook.com<https://urldefense.com/v3/__https://groups.google.com/a/soe.ucsc.edu/d/msgid/genome/DS0PR20MB653683C8FC20C8FDD53DE6119ED8A*40DS0PR20MB6536.namprd20.prod.outlook.com?utm_medium=email&utm_source=footer__;JQ!!ODpDvJZr5w!HbTQdrXl23LNDMhO8EZAg0Mt4pzSZfUgI9acw-DySBops7KxyG3dgX2ZgKj1ibTi_iiUot6DX_9K-6aPCDyc6uhPMw$>.

>
> Regeneron - Internal
>
> Regeneron - Internal
>

> Regeneron - Internal
>