# Security Policy

[完整中文说明](./SECURITY.zh.md)

Security reports and careful review are welcome. This is a first-time maintainer project, so the policy states both the controls already implemented and the boundaries that still require user judgment.

欢迎报告安全问题并参与审查。这是维护者第一次做开源项目，因此本策略会同时说明已经实现的控制和仍需用户自行判断的边界。

## Supported versions / 支持版本

| Version / 版本 | Supported / 是否支持 |
|---|---|
| 0.2.x | Yes / 是 |
| 0.1.x | No / 否 |

## Private reporting / 私下报告

Do not open a public issue for a suspected vulnerability. Use [GitHub Security Advisories](https://github.com/superboy911/dsh-model-router/security/advisories/new) to send a private report. Include the affected version, reproduction steps, impact, and the smallest sanitized example.

疑似漏洞请不要提交公开 Issue。请通过 [GitHub Security Advisories](https://github.com/superboy911/dsh-model-router/security/advisories/new) 私下报告，并提供受影响版本、复现步骤、影响范围和最小脱敏样例。

If private reporting is unavailable, open a public issue containing no exploit details or secrets and ask the maintainer to provide a private channel. / 如果私下报告入口暂时不可用，请提交一个不包含利用细节和敏感信息的公开 Issue，请维护者提供私下沟通渠道。

## Never include / 禁止提交

- API keys, bearer tokens, or credential-store exports / API Key、Bearer Token 或凭据库导出；
- DSH settings or credential files / DSH 设置或凭据文件；
- signed image-result URLs / 带签名的图片结果地址；
- private provider endpoints or internal model names / 私有提供方端点或内部模型名称；
- generated artifacts or local absolute paths / 生成产物或本机绝对路径；
- employer, customer, production, or personal data / 单位、客户、生产或个人数据。

If a credential is disclosed, revoke or rotate it immediately. Removing it from the latest commit is not sufficient because Git history and external caches may retain it. / 如果凭据已经泄露，请立即吊销或轮换。只从最新提交删除并不够，因为 Git 历史和外部缓存仍可能保留它。

## Implemented controls / 已实现控制

- Media API endpoints require HTTPS, except explicit loopback hosts (`localhost`, `127.0.0.0/8`, `::1`) used for local development. / 媒体 API 端点必须使用 HTTPS；只有本机开发使用的明确回环地址可以使用 HTTP。
- Endpoint URLs reject embedded usernames, passwords, query strings, and fragments. / 端点 URL 拒绝内嵌用户名、密码、查询参数和锚点。
- Empty credential references send no Authorization header. / 凭据引用留空时不发送 Authorization 请求头。
- Route targets are validated before changing a session. / 修改会话前校验路由目标。
- `model_route` stays disabled without a non-empty explicit allowlist. / 没有非空明确白名单时不注册 `model_route`。
- Image downloads validate scheme, allowed host, DNS results, redirects, size, and magic bytes. / 生图下载校验协议、允许域名、DNS 结果、重定向、大小和文件魔数。
- Settings POST requests require same-origin JSON requests. / 设置写操作要求同源 JSON 请求。
- Caught server exceptions stay in local logs; HTTP clients receive stable codes and fixed bilingual messages. / 捕获到的服务端异常只保留在本机日志中，HTTP 客户端只收到稳定错误码和固定双语提示。
- CI runs a repository and Git-history secret scan. / 持续集成会扫描当前仓库和 Git 历史中的高可信敏感信息。
- CodeQL runs for the public repository. Private-repository analysis requires separately enabled GitHub Advanced Security and is not enabled automatically. / 公开仓库会运行 CodeQL；私有仓库分析需要另行启用 GitHub Advanced Security，本项目不会自动开启。

## Boundaries / 能力边界

These controls do not prove a provider is trustworthy, protect a compromised DSH host, audit third-party plugins, validate every possible secret format, or replace review of billing and provider permissions. / 上述控制不能证明提供方一定可信，不能保护已经失陷的 DSH 主机，不能替代第三方插件审查，也无法识别世界上所有密钥格式，更不能代替费用和账号权限检查。

The built-in scanner is a high-confidence safety net, not a formal security audit. GitHub secret scanning and human review should remain enabled. / 内置扫描器只是高可信兜底，不等于正式安全审计；仍应保持 GitHub 密钥扫描并进行人工审查。