# Security policy

LMR stores provider credentials and issues API keys, so security reports get
priority over other work.

## Report a vulnerability

Do not open a public issue for a security problem.

Send a report to **lovro@govekar.net**. Put `LMR security` in the subject. Include:

- The version or commit you tested.
- Steps that reproduce the problem.
- The impact as you understand it.

You get a reply within 7 days. Fixes for confirmed problems ship as a patch
release, and the release notes credit you unless you ask otherwise.

## Supported versions

Only the latest release and the `master` branch receive security fixes.

## Scope

In scope:

- The Go server: proxy routes under `/v1`, admin routes under `/api/admin`,
  the OIDC login flow, and the database layer.
- The management dashboard.
- The Docker images and the compose files in this repository.

Out of scope:

- Problems in upstream model providers.
- Deployments that changed the default configuration in an unsafe way, such
  as running without TLS in front of the gateway.
- Denial of service through normal API use. Rate limits are per model and are
  the operator's responsibility to set.

## Design notes for reviewers

- Virtual keys are stored as SHA-256 hashes. The plain key is shown once.
- Provider credentials are stored encrypted with AES-256-GCM. The key comes
  from `GATEWAY_SECURITY_ENCRYPTION_KEY` and is never written to the database.
- Admin routes require an OIDC ID token whose `groups` claim contains the
  configured admin group. Proxy routes require a virtual key.
- Request logs store prompt and completion text. Inline image data is replaced
  by a size marker before it is written.