LovroG05
353af96238
Prepare the repository for a public release. Ignore local Claude Code session files.
1.6 KiB
1.6 KiB
Security policy
LMR stores provider credentials and issues API keys, so security reports get priority over other work.
Report a vulnerability
Do not open a public issue for a security problem.
Send a report to lovro@govekar.net. Put LMR security in the subject. Include:
- The version or commit you tested.
- Steps that reproduce the problem.
- The impact as you understand it.
You get a reply within 7 days. Fixes for confirmed problems ship as a patch release, and the release notes credit you unless you ask otherwise.
Supported versions
Only the latest release and the master branch receive security fixes.
Scope
In scope:
- The Go server: proxy routes under
/v1, admin routes under/api/admin, the OIDC login flow, and the database layer. - The management dashboard.
- The Docker images and the compose files in this repository.
Out of scope:
- Problems in upstream model providers.
- Deployments that changed the default configuration in an unsafe way, such as running without TLS in front of the gateway.
- Denial of service through normal API use. Rate limits are per model and are the operator's responsibility to set.
Design notes for reviewers
- Virtual keys are stored as SHA-256 hashes. The plain key is shown once.
- Provider credentials are stored encrypted with AES-256-GCM. The key comes
from
GATEWAY_SECURITY_ENCRYPTION_KEYand is never written to the database. - Admin routes require an OIDC ID token whose
groupsclaim contains the configured admin group. Proxy routes require a virtual key. - Request logs store prompt and completion text. Inline image data is replaced by a size marker before it is written.