# Security Policy

## Reporting a vulnerability

Please do not open a public issue for a security problem.

[**Report privately through GitHub**](https://github.com/Tisankan-dev/openrouter-ai-sdks/security/advisories/new)

Or email **hello@tisankan.dev** with `openrouter-ai-sdks security` in the subject line.

Include what you found, how to reproduce it, and what an attacker could do with it. You will get an acknowledgement within 72 hours.

## Supported versions

Only the latest published version receives fixes. Please upgrade before reporting.

## What this package touches

Worth knowing when you assess risk.

It sends your prompts and your API key to OpenRouter. The key is read from the configuration you pass and is never persisted or logged by this package.

- **No telemetry.** Nothing about you or your project is reported anywhere.
- **No install scripts.** This package runs no `postinstall` or `preinstall` hook.

## Scope

In scope: anything that causes the package to leak credentials, execute unintended code, or send data somewhere you did not configure.

Out of scope: vulnerabilities in dependencies, which should go to that project first. Telling us as well is appreciated so the constraint can be bumped.