Security
Security Policy
Supported versions and how to report a security issue privately.
Security 1 min read
Supported versions
| Version | Supported |
|---|---|
| 2.1.x | yes |
| 2.0.x | security fixes only, until 2027-01-13 |
| < 2.0 | no |
Reporting a vulnerability
Please do not open a public issue or work item. Email security@opensmartroute.ai. Include a
proof-of-concept and the version affected. You will receive an acknowledgement within 72 hours and
a fix or mitigation plan within 14 days for high/critical issues.
Scope
- Routing control-plane integrity (adversarial rerouting, confounder gadgets)
- Prompt-injection into the LLM-judge strategy
- PII / sensitive-data leakage through logs, caches, traces, or feedback stores
- Policy bypass (region, data boundary, tenant, budget)
- Denial of service via oversized inputs or state growth
See docs/SECURITY.md for the threat model and the controls implemented, and
docs/SECURITY_REVIEW.md if you are running an independent review.
Something wrong or out of date on this page? Tell us - the page is named for you, so a one-line note is enough.