Security fixes are applied on the latest default branch of this repository.
Please do not open a public issue for security vulnerabilities that could enable abuse (auth bypass, SSRF, credential leakage, remote code execution, etc.).
Instead, report privately via GitHub Security Advisories for dev2k6/LLMProxyAS, or contact the repository owner, with:
- Description of the issue and impact
- Steps to reproduce
- Affected commit or release tag
- Optional proof-of-concept (non-destructive)
You should receive an acknowledgement when the report is triaged. Please allow reasonable time for a fix before public disclosure.
| Boundary | Behavior |
|---|---|
| Client → LLMProxyAS | No built-in authentication. Anyone who can reach the listen port can call the API. |
| LLMProxyAS → upstream | Uses client Authorization if present; otherwise injects api_key from config. |
| Model access | Restricted by configs/allowed_models.json. |
| Secrets | Expected in local config / secret mounts — not in git. |
- Bind to a private interface or place behind a reverse proxy / API gateway with auth (mTLS, OAuth2, IP allow-list).
- Keep
api_keyonly on the server; do not distribute upstream keys to clients. - Restrict
allowed_models.jsonto the minimum set of models. - Run the container as non-root (default image) and mount configs read-only.
- Monitor logs for anomalous model or volume usage.
- Set network egress so the proxy can only reach intended upstream hosts if your environment allows.
- Multi-tenant client API keys
- Rate limiting / quota enforcement
- Per-user audit export
- Automatic secret rotation
These may be added later; until then, enforce them outside LLMProxyAS when required.