# Security Policy

## Supported Versions

| Version | Supported |
|---------|-----------|
| 0.x.x   | Yes       |

## Reporting a Vulnerability

**Do NOT open a public GitHub issue for security vulnerabilities.**

Instead, please email security concerns to: **brendon@llmhosts.com**

Include:
- Description of the vulnerability
- Steps to reproduce
- Affected version(s)
- Impact assessment

## Response Timeline

- **Acknowledgment**: Within 48 hours
- **Initial assessment**: Within 1 week
- **Fix or mitigation**: Within 2 weeks for critical issues

## Scope

The following are in scope:
- `llmhost` Python package (PyPI)
- API proxy endpoints (`/v1/chat/completions`, `/v1/messages`, `/v1/models`)
- Authentication and key management (`/api/keys/*`)
- Tunnel functionality (`llmhosts tunnel`)
- Docker images (`ghcr.io/looknohandsmom/llmhosts.com`)

The following are out of scope:
- Third-party dependencies (report upstream)
- Social engineering attacks
- Denial of service against local-only instances

## Disclosure Policy

We follow coordinated disclosure. We will:
1. Confirm receipt of your report
2. Investigate and determine impact
3. Develop and test a fix
4. Release the fix and publish an advisory
5. Credit the reporter (unless anonymity is requested)
