Security fixes are accepted for the latest published release and the current main branch.

Do not open a public issue for secrets, authentication bypasses, remote code execution, or other sensitive vulnerabilities.

Report security issues by opening a private GitHub security advisory, or by contacting the maintainer through the repository profile. Include:

• Affected version or commit.
• Reproduction steps.
• Impact and expected behavior.
• Any logs or screenshots with secrets removed.

The router handles API keys and local model traffic. Please rotate any key that may have appeared in logs, issues, screenshots, or git history.