Model Router Security Policy

Reporting Security Vulnerabilities

If you discover any security issues with API token handling, prompt injection vectors, or data exposure, please contact the maintainers immediately.

API Keys: External provider tokens (OpenAI, Anthropic, Gemini) are read strictly from local environment variables (.env) or secure system secrets.
Logs & Transcripts: All outgoing observability logs automatically redact authorization headers, bearer tokens, and secrets.
Database Integrity: SQLite storage only stores model identifiers and usage statistics; raw credentials are never persisted in plaintext database tables.
Browser Privacy: Frontend client queries never receive or handle backend API keys.