Security updates are provided only for the latest released version of Radicalbit AI Gateway. Older versions are not supported and users are encouraged to upgrade promptly.

We take the security of Radicalbit AI Gateway seriously. If you believe you have found a security vulnerability, please report it responsibly.

Preferred channel: please use GitHub's private vulnerability reporting feature, available under the "Security" tab of this repository.

Alternative channel: if you are unable to use GitHub's private reporting, you can email us at security@radicalbit.ai.

Do not report security vulnerabilities through public GitHub issues, discussions, or pull requests, as this could put users at risk before a fix is available.

To help us triage and respond efficiently, please include as much of the following as possible:

• A clear description of the vulnerability and its root cause
• The affected version(s) and configuration
• Step-by-step instructions to reproduce the issue
• The potential impact (e.g., data exposure, privilege escalation, remote code execution)
• Any known mitigations, workarounds, or suggested fixes
• Proof-of-concept code, if available

• Acknowledgement: We will acknowledge receipt of your report within 7 calendar days. This acknowledgement does not imply that the vulnerability has been confirmed or that it will be resolved within that timeframe.
• Updates: Following the initial acknowledgement, we will provide status updates whenever significant progress is made.
• Assessment: If the report is accepted, we will assess its impact, develop and test a remediation, and coordinate disclosure with you.
• Declined reports: If the report is declined (e.g., not reproducible or out of scope), we will provide an explanation whenever reasonably possible.

We kindly ask that you keep any details of the vulnerability confidential until we have completed our investigation and agreed on a coordinated disclosure timeline. This helps protect users while a fix is developed and released.

Thank you for helping keep Radicalbit AI Gateway and its users safe.