42 lines
1.6 KiB
Markdown
42 lines
1.6 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| :--- | :--- |
|
|
| `1.0.x` | Yes |
|
|
| `< 1.0` | No |
|
|
|
|
---
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
The Model Router team takes security and data privacy seriously. If you discover a vulnerability, please report it privately.
|
|
|
|
**DO NOT disclose vulnerabilities in public GitHub issues or discussions.**
|
|
|
|
### How to Report Privately
|
|
Please email your findings directly to the security team at:
|
|
**[picadolabs@gmail.com](mailto:picadolabs@gmail.com)**
|
|
|
|
### What to Include in Your Report
|
|
To help us triage and resolve the issue quickly, please include:
|
|
1. Description of the vulnerability.
|
|
2. Steps to reproduce the issue (including sample payloads or configuration).
|
|
3. Potential impact and attack vectors.
|
|
4. Any proposed fixes or remediations if available.
|
|
|
|
### Response Timeline
|
|
- **Initial Response**: Within 48 hours of receipt.
|
|
- **Triage & Assessment**: Within 5 business days.
|
|
- **Remediation & Patch Release**: Coordinated with the reporter prior to public release.
|
|
|
|
---
|
|
|
|
## Security Principles & Architecture
|
|
|
|
Model Router is built with defense-in-depth principles:
|
|
1. **Zero-Secret Exposure**: Provider API keys (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `GEMINI_API_KEY`) are read strictly from local environment variables and never stored in SQLite database tables or returned to web clients.
|
|
2. **Log Redaction**: Observability logging automatically sanitizes dictionary keys matching authorization headers and secret patterns.
|
|
3. **Local-First Privacy**: Complete inference can run locally via Mock or Ollama providers with zero telemetry sent to third-party cloud servers.
|