# Security Policy ## Supported versions | Version | Supported | |---|---| | 2.1.x | yes | | 2.0.x | security fixes only, until 2027-01-13 | | < 2.0 | no | ## Reporting a vulnerability Please **do not** open a public issue or work item. Email `security@opensmartroute.ai`. Include a proof-of-concept and the version affected. You will receive an acknowledgement within 72 hours and a fix or mitigation plan within 14 days for high/critical issues. ## Scope - Routing control-plane integrity (adversarial rerouting, confounder gadgets) - Prompt-injection into the LLM-judge strategy - PII / sensitive-data leakage through logs, caches, traces, or feedback stores - Policy bypass (region, data boundary, tenant, budget) - Denial of service via oversized inputs or state growth See `docs/SECURITY.md` for the threat model and the controls implemented, and `docs/SECURITY_REVIEW.md` if you are running an independent review.