Security fixes are provided for the latest released version of ReqLLM. Published security advisories identify the affected versions and the version that contains the fix.

See the list of published security advisories.

Report a suspected vulnerability with GitHub private vulnerability reporting.

Do not report a vulnerability in a public issue, discussion, or pull request.

Include this information when possible:

• A clear description of the vulnerability
• The affected versions
• Reproduction steps or a proof of concept
• The affected files or functions
• The possible confidentiality, integrity, or availability impact
• Known workarounds or a proposed fix
• Whether you shared the information with another party
• Whether you want public credit

Do not include real API keys, access tokens, private prompts, or user data.

We aim to acknowledge a report within two business days. We will assess its scope and severity, keep the reporter informed of important changes, and develop and test a fix in private.

We use coordinated vulnerability disclosure. We will agree on a public disclosure date with the reporter and other coordinators. The date can depend on severity, active exploitation, fix complexity, and downstream risk.

For vulnerabilities in the Hex package, we can coordinate CVE assignment and publication with the Erlang Ecosystem Foundation CVE Numbering Authority.

We will give public credit when the reporter requests it.

Make a good-faith effort to:

• Avoid privacy violations
• Avoid service disruption or data destruction
• Access only the data that is necessary to demonstrate the vulnerability
• Keep vulnerability details private during the coordinated disclosure

We will not start legal action for good-faith security research that follows this policy.

This project does not operate a bug bounty program or promise payment for reports.