The Model Router team takes security and data privacy seriously. If you discover a vulnerability, please report it privately.

DO NOT disclose vulnerabilities in public GitHub issues or discussions.

Please email your findings directly to the security team at: picadolabs@gmail.com

To help us triage and resolve the issue quickly, please include:

1. Description of the vulnerability.
2. Steps to reproduce the issue (including sample payloads or configuration).
3. Potential impact and attack vectors.
4. Any proposed fixes or remediations if available.

• Initial Response: Within 48 hours of receipt.
• Triage & Assessment: Within 5 business days.
• Remediation & Patch Release: Coordinated with the reporter prior to public release.

Model Router is built with defense-in-depth principles:

1. Zero-Secret Exposure: Provider API keys (OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY) are read strictly from local environment variables and never stored in SQLite database tables or returned to web clients.
2. Log Redaction: Observability logging automatically sanitizes dictionary keys matching authorization headers and secret patterns.
3. Local-First Privacy: Complete inference can run locally via Mock or Ollama providers with zero telemetry sent to third-party cloud servers.