Security Policy
Supported versions and how to report a security issue privately.
Supported versions#
| Version | Supported |
|---|---|
| 0.5.x | yes |
| 0.4.x | security fixes only |
| < 0.4 | no |
Reporting a vulnerability#
Please do not open a public issue. Email security@opensmartroute.org (or use GitHub's
private vulnerability reporting on this repository). Include a proof-of-concept and the
version affected. You will receive an acknowledgement within 72 hours and a fix or
mitigation plan within 14 days for high/critical issues.
Scope#
- Routing control-plane integrity (adversarial rerouting, confounder gadgets)
- Prompt-injection into the LLM-judge strategy
- PII / sensitive-data leakage through logs, caches, traces, or feedback stores
- Policy bypass (region, data boundary, tenant, budget)
- Denial of service via oversized inputs or state growth
See docs/SECURITY.md for the threat model and the controls implemented, and
docs/SECURITY_REVIEW.md if you are running an independent review.