Security fixes are applied on a best-effort basis to the default branch of this repository. There is no long-term support promise for older tags.

Please report security issues through GitHub private security advisories on this repository:

1. Open the repository on GitHub.
2. Use Security → Advisories → Report a vulnerability (or the equivalent “New draft security advisory” flow for maintainers).
3. Include a clear description, impact, and steps to reproduce. Do not include production secrets.

Do not open a public issue for unfixed vulnerabilities.

We do not publish a separate security contact email. Private GitHub advisories are the supported channel.

muse-shim is a local loopback proxy that may hold OAuth tokens or API keys in process memory and may refresh credentials on disk. Reports related to secret leakage, unsafe default binds, credential file handling, SSRF-style host overrides, or logging of sensitive data are especially relevant.

Out of scope examples: third-party provider outages, Muse CLI bugs unrelated to this proxy, and account abuse against OpenAI/Anthropic/Meta.

• Keep the default loopback bind (127.0.0.1).
• Do not pass --allow-non-loopback or --allow-oauth-host-override unless you understand the risk.
• Do not enable verbose logging in shared environments if your threat model includes local log access (bodies and keys are not logged by design, but request metadata may still be sensitive).
• Treat ~/.codex/auth.json, Claude credential files, and API keys like passwords.