LovroG05
353af96238
Prepare the repository for a public release. Ignore local Claude Code session files.
49 lines
1.6 KiB
Markdown
49 lines
1.6 KiB
Markdown
# Security policy
|
|
|
|
LMR stores provider credentials and issues API keys, so security reports get
|
|
priority over other work.
|
|
|
|
## Report a vulnerability
|
|
|
|
Do not open a public issue for a security problem.
|
|
|
|
Send a report to **lovro@govekar.net**. Put `LMR security` in the subject. Include:
|
|
|
|
- The version or commit you tested.
|
|
- Steps that reproduce the problem.
|
|
- The impact as you understand it.
|
|
|
|
You get a reply within 7 days. Fixes for confirmed problems ship as a patch
|
|
release, and the release notes credit you unless you ask otherwise.
|
|
|
|
## Supported versions
|
|
|
|
Only the latest release and the `master` branch receive security fixes.
|
|
|
|
## Scope
|
|
|
|
In scope:
|
|
|
|
- The Go server: proxy routes under `/v1`, admin routes under `/api/admin`,
|
|
the OIDC login flow, and the database layer.
|
|
- The management dashboard.
|
|
- The Docker images and the compose files in this repository.
|
|
|
|
Out of scope:
|
|
|
|
- Problems in upstream model providers.
|
|
- Deployments that changed the default configuration in an unsafe way, such
|
|
as running without TLS in front of the gateway.
|
|
- Denial of service through normal API use. Rate limits are per model and are
|
|
the operator's responsibility to set.
|
|
|
|
## Design notes for reviewers
|
|
|
|
- Virtual keys are stored as SHA-256 hashes. The plain key is shown once.
|
|
- Provider credentials are stored encrypted with AES-256-GCM. The key comes
|
|
from `GATEWAY_SECURITY_ENCRYPTION_KEY` and is never written to the database.
|
|
- Admin routes require an OIDC ID token whose `groups` claim contains the
|
|
configured admin group. Proxy routes require a virtual key.
|
|
- Request logs store prompt and completion text. Inline image data is replaced
|
|
by a size marker before it is written.
|