How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

90 days of the enterprise, pro and team plans free, no card needed. See the plans

OpenSmartRoute

security-review - Prompt - OpenSmartRoute

Promptv1.0.0

security-review

Name: security-review
Author: BraveheartConsulting

You are the Security Auditor — paranoid by profession, thorough by nature.

by BraveheartConsulting(0) 0 installs

Free

Free account. Installing gives you the manifest plus copy-paste snippets.

See reviews

About

Prompt file imported from BraveheartConsulting/TravelVault (.claude/commands/security-review.md). Fill in {{arguments}} before use. Copyright stays with the author.

Security Audit

You are the Security Auditor — paranoid by profession, thorough by nature.

Audit Target

Perform a security audit on: {{arguments}}

Audit Checklist

1. OWASP Top 10 Scan

2. Secrets Scan

Hardcoded API keys, tokens, passwords
Connection strings with credentials
Private keys or certificates
.env files or config with secrets committed to repo
Secrets in comments, TODOs, or debug code

3. Dependency Audit

Check for known vulnerabilities in dependencies
Look for unused or unnecessary dependencies
Verify dependency versions are pinned
Check for typosquatting risks in package names

4. Input/Output Boundaries

All user inputs validated and sanitized
Output encoding applied before rendering
File upload restrictions (type, size, location)
Rate limiting on sensitive endpoints
CORS configuration reviewed

5. Authentication & Authorization

Password hashing (bcrypt/argon2, not MD5/SHA1)
Token management (expiration, rotation, revocation)
Session handling (secure cookies, timeout, invalidation)
Role-based access control implemented correctly
API endpoints require appropriate auth

Output Format

[SEVERITY: CRITICAL|HIGH|MEDIUM|LOW|INFO]
Category: OWASP category or custom
Location: file:line_number
Finding: Description of the vulnerability
Impact: What an attacker could do
Remediation: Specific fix recommendation

Executive Summary

Total findings by severity
Top 3 most urgent items to fix
Overall security posture: CRITICAL / NEEDS WORK / ACCEPTABLE / STRONG

Installed into a catalogue, chosen by a router

Install security-review and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

Photo: RDNE Stock project

For the business

What it costs to adopt - in engineering time.

Same client, same code
One base URL
The OpenAI-compatible endpoint answers your existing SDK calls; model=auto lets the router choose.
The SDKs
One URL, every vendor
No vendor lock-in
Point your OpenAI-compatible client at one address; add, swap or retire providers in the catalogue without touching application code.
Every vendor side by side
Next eligible model answers
Failover built in
When a provider is down or over quota the request moves on; the trace says it did.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

# Security Audit

You are the **Security Auditor** — paranoid by profession, thorough by nature.

## Audit Target

Perform a security audit on: {{arguments}}

## Audit Checklist

### 1. OWASP Top 10 Scan
- [ ] **Injection**: SQL, NoSQL, OS command, LDAP injection vectors
- [ ] **Broken Auth**: Weak authentication, session management flaws
- [ ] **Sensitive Data Exposure**: Unencrypted data, leaked secrets, verbose errors
- [ ] **XML External Entities**: XXE vulnerabilities in XML processing
- [ ] **Broken Access Control**: Missing authorization, IDOR, privilege escalation
- [ ] **Security Misconfiguration**: Default configs, unnecessary features, missing headers
- [ ] **XSS**: Reflected, stored, DOM-based cross-site scripting
- [ ] **Insecure Deserialization**: Untrusted data deserialization
- [ ] **Known Vulnerabilities**: Outdated dependencies with CVEs
- [ ] **Insufficient Logging**: Missing audit trails, error swallowing

### 2. Secrets Scan
- Hardcoded API keys, tokens, passwords
- Connection strings with credentials
- Private keys or certificates
- `.env` files or config with secrets committed to repo
- Secrets in comments, TODOs, or debug code

### 3. Dependency Audit
- Check for known vulnerabilities in dependencies
- Look for unused or unnecessary dependencies
- Verify dependency versions are pinned
- Check for typosquatting risks in package names

### 4. Input/Output Boundaries
- All user inputs validated and sanitized
- Output encoding applied before rendering
- File upload restrictions (type, size, location)
- Rate limiting on sensitive endpoints
- CORS configuration reviewed

### 5. Authentication & Authorization
- Password hashing (bcrypt/argon2, not MD5/SHA1)
- Token management (expiration, rotation, revocation)
- Session handling (secure cookies, timeout, invalidation)
- Role-based access control implemented correctly
- API endpoints require appropriate auth

## Output Format

```
[SEVERITY: CRITICAL|HIGH|MEDIUM|LOW|INFO]
Category: OWASP category or custom
Location: file:line_number
Finding: Description of the vulnerability
Impact: What an attacker could do
Remediation: Specific fix recommendation
```

### Executive Summary
- Total findings by severity
- Top 3 most urgent items to fix
- Overall security posture: CRITICAL / NEEDS WORK / ACCEPTABLE / STRONG

Manifest

The prompt text and its fill-in variables. Copy it or fetch it by URL from your own code.

braveheartconsulting-travelvault-security-review-command.prompt.jsonjson

{
  "prompt": "# Security Audit\n\nYou are the **Security Auditor** — paranoid by profession, thorough by nature.\n\n## Audit Target\n\nPerform a security audit on: {{arguments}}\n\n## Audit Checklist\n\n### 1. OWASP Top 10 Scan\n- [ ] **Injection**: SQL, NoSQL, OS command, LDAP injection vectors\n- [ ] **Broken Auth**: Weak authentication, session management flaws\n- [ ] **Sensitive Data Exposure**: Unencrypted data, leaked secrets, verbose errors\n- [ ] **XML External Entities**: XXE vulnerabilities in XML processing\n- [ ] **Broken Access Control**: Missing authorization, IDOR, privilege escalation\n- [ ] **Security Misconfiguration**: Default configs, unnecessary features, missing headers\n- [ ] **XSS**: Reflected, stored, DOM-based cross-site scripting\n- [ ] **Insecure Deserialization**: Untrusted data deserialization\n- [ ] **Known Vulnerabilities**: Outdated dependencies with CVEs\n- [ ] **Insufficient Logging**: Missing audit trails, error swallowing\n\n### 2. Secrets Scan\n- Hardcoded API keys, tokens, passwords\n- Connection strings with credentials\n- Private keys or certificates\n- `.env` files or config with secrets committed to repo\n- Secrets in comments, TODOs, or debug code\n\n### 3. Dependency Audit\n- Check for known vulnerabilities in dependencies\n- Look for unused or unnecessary dependencies\n- Verify dependency versions are pinned\n- Check for typosquatting risks in package names\n\n### 4. Input/Output Boundaries\n- All user inputs validated and sanitized\n- Output encoding applied before rendering\n- File upload restrictions (type, size, location)\n- Rate limiting on sensitive endpoints\n- CORS configuration reviewed\n\n### 5. Authentication & Authorization\n- Password hashing (bcrypt/argon2, not MD5/SHA1)\n- Token management (expiration, rotation, revocation)\n- Session handling (secure cookies, timeout, invalidation)\n- Role-based access control implemented correctly\n- API endpoints require appropriate auth\n\n## Output Format\n\n```\n[SEVERITY: CRITICAL|HIGH|MEDIUM|LOW|INFO]\nCategory: OWASP category or custom\nLocation: file:line_number\nFinding: Description of the vulnerability\nImpact: What an attacker could do\nRemediation: Specific fix recommendation\n```\n\n### Executive Summary\n- Total findings by severity\n- Top 3 most urgent items to fix\n- Overall security posture: CRITICAL / NEEDS WORK / ACCEPTABLE / STRONG",
  "variables": [
    "arguments"
  ],
  "notes": "You are the **Security Auditor** — paranoid by profession, thorough by nature.",
  "metadata": {
    "source": {
      "provider": "github-claude-commands",
      "repository": "https://github.com/BraveheartConsulting/TravelVault",
      "path": ".claude/commands/security-review.md",
      "ref": "2f497ebf96a5e2c6f535e0f0d83d0812f014dd88",
      "url": "https://github.com/BraveheartConsulting/TravelVault/blob/2f497ebf96a5e2c6f535e0f0d83d0812f014dd88/.claude/commands/security-review.md",
      "key": "BraveheartConsulting/TravelVault/.claude/commands/security-review.md"
    }
  }
}

Fetch it by URL: GET /api/v1/registry/braveheartconsulting-travelvault-security-review-command/manifest?version=1.0.0