Self-hosted software, one running version per deployment — there is no LTS branch to track. Security
fixes land on main and ship in the next tagged v* release. Only the latest tagged release is
supported; upgrade to it before reporting an issue against an older tag.
Report privately, through GitHub Security Advisories — do not open a public issue.
Use Report a vulnerability on this repository (requires the advisory feature to be enabled in the repo settings; see below). This opens a private advisory visible only to maintainers until a fix is ready, so a live exploit path isn't disclosed while it's still exploitable.
Include what you'd want if you were on the other end: affected version/commit, reproduction steps,
and impact (what an attacker gains — see the threat model and blast-radius table in
docs/idea/07-security.md for the shapes we already reason about, e.g.
ENCRYPTION_KEY exposure, admin-plane access, or the Agent-SDK tool-execution path).
- Acknowledgement: within 3 business days.
- Triage and severity call: within 7 days of acknowledgement.
- Fix or mitigation timeline communicated once triaged; critical issues (anything reaching the blast-radius table's higher rows — credential exposure, host tool execution) are prioritized over everything else in flight.
This is self-hosted software with a single admin, run by whoever deploys it — there is no multi-tenant hosted service and no bug bounty program.
In scope:
- The router itself: data plane (
/v1/**), admin plane (/api/admin/**), the Agent-SDK tool passthrough path, credential handling, redaction, and the provider drivers in this repository.
Out of scope:
- Deployment mistakes covered by the hardening checklist
— e.g. running without HTTPS or a reverse proxy, misconfiguring the OIDC client or principal pins,
or losing
ENCRYPTION_KEY. The admin plane may be internet-facing by design when protected by the documented OIDC flow; exposure is not itself a vulnerability. A bypass of OIDC, PKCE, ID-token verification, the configured email/subject match, session protections, or CSRF is in scope. - Vulnerabilities in upstream providers (Anthropic, OpenAI, etc.) — report those to the provider.
- Social engineering, physical access, or anything requiring prior compromise of the host itself.
Full threat model, admin OIDC controls, redaction rules, and secrets handling:
docs/idea/07-security.md and
docs/idea/13-admin-oidc.md.