Security and privacy

The guarantees

The agent context boundary

Provider text is untrusted data. A block injected into a prompt is an injection surface, so the pipeline is built so that no provider supplied text can reach it.

• Connector parsers select known numeric fields and known timestamps. They discard labels, messages, account text, markup, and every unknown field.
• The advice engine emits only provider enum codes, reason enum codes, bounded percentages, freshness enum codes, and timestamps.
• The Claude Code adapter validates all of those again and wraps them in an explicit untrusted data boundary before anything is written.
• If every provider is unknown, the adapter injects nothing.

The exact block, field by field, is on the agent context page.

Secret handling

The only credential the project has a concept of is an OpenRouter key, and it belongs in your operating system credential store. It must never appear in repository files, cache files, exports, diagnostics, fixtures, or logs. The credential library call sits behind an interface, and the tests use only a memory implementation with a synthetic key.

Local state

The state directory is created with restrictive permissions where the platform supports them, a path that turns out to be a symbolic link is rejected rather than followed, and every file replacement is atomic. See configuration for the paths.

Honest limitations

If a future connector goes to the network

This release performs no provider egress. A future connector that does would have to satisfy all of the following before it could ship.

• Declare one exact provider host.
• Use secure transport and reject any redirect outside that host.
• Set a short timeout and bound the response size.
• Document its interface status honestly.
• Send no cache content, no other provider state, no prompts, no source code, and no diagnostics.

Reporting a problem

Report a suspected vulnerability privately to security@openlimiter.com. Include a concise description, the affected version, reproduction steps using synthetic data, and the expected impact. Do not include real credentials or provider account data. That address is a project placeholder until the public security intake is activated.

In scope: secret disclosure, provider artifact mutation, unsafe cache behaviour, symbolic link bypass, parser bounds bypass, agent context injection, and unexpected network egress. Connector drift with no security impact is a compatibility issue, so please open a connector request instead. The full policy lives in SECURITY.md and the reasoning in THREAT_MODEL.md.

Only the latest released version receives security fixes during the initial development period.