akadmin/headroom
1
0
Fork 0
mirror of https://github.com/headroomlabs-ai/headroom.git synced 2026-08-27 14:17:10 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
headroom/SECURITY.md
chopratejas 175746cc26 Prepare for OSS release v0.2.0 
This commit prepares Headroom for public open source release with
comprehensive documentation, licensing, and community infrastructure.

License & Legal:
- Add Apache 2.0 LICENSE file
- Add NOTICE file with third-party attributions
- Add SECURITY.md for vulnerability reporting

Community:
- Add CONTRIBUTING.md with contribution guidelines
- Add CODE_OF_CONDUCT.md (Contributor Covenant)
- Add GitHub issue templates (bug report, feature request)
- Add pull request template

Documentation:
- Update README.md with compelling value proposition
- Add docs/getting-started.md
- Add docs/proxy.md for proxy server documentation
- Add docs/transforms.md for transform reference
- Add docs/api.md for API reference
- Add examples/README.md

Package Infrastructure:
- Add headroom/py.typed for PEP 561 compliance
- Add headroom/cli.py for CLI entry point
- Add .github/workflows/ci.yml for CI pipeline
- Add .github/workflows/publish.yml for PyPI publishing
- Update pyproject.toml with proper metadata

New Features:
- Add multi-provider support (Google, Cohere, LiteLLM, OpenAI-compatible)
- Add universal tokenizer registry with multiple backends
- Add model registry with pricing and context limits
- Add production proxy server with caching and rate limiting

Code Quality:
- Fix 83 lint issues via ruff auto-fix
- Fix version consistency (benchmarks 0.1.0 → 0.2.0)
- Add skip decorators for optional dependency tests
2026-01-07 11:36:44 -08:00

2.2 KiB
Raw Blame History

Security Policy

Supported Versions

Version Supported
0.2.x ✅
0.1.x ❌

Reporting a Vulnerability

We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

How to Report

Please DO NOT open a public GitHub issue for security vulnerabilities.

Instead, please email us at: security@headroom.dev

Include the following information:

  • Type of vulnerability (e.g., injection, data exposure, authentication bypass)
  • Full path of the affected source file(s)
  • Step-by-step instructions to reproduce the issue
  • Proof-of-concept or exploit code (if possible)
  • Impact assessment

What to Expect

  1. Acknowledgment: We will acknowledge receipt within 48 hours
  2. Assessment: We will assess the vulnerability and determine its severity
  3. Updates: We will keep you informed of our progress
  4. Resolution: We aim to resolve critical issues within 7 days
  5. Credit: With your permission, we will credit you in the security advisory

Security Best Practices for Users

When using Headroom:

  1. API Keys: Never commit API keys. Use environment variables.
  2. Proxy Exposure: Don't expose the proxy server to the public internet without authentication
  3. Log Files: Be aware that request logs may contain sensitive information
  4. Budget Limits: Set budget limits to prevent unexpected costs

Scope

The following are in scope for security reports:

  • Headroom Python package (pip install headroom)
  • Headroom proxy server
  • Official integrations (LangChain, MCP)

The following are out of scope:

  • Third-party integrations not maintained by us
  • Issues in dependencies (report these to the upstream project)
  • Social engineering attacks

Security Features

Headroom includes several security features:

  • No credential storage: We never store or log API keys
  • Passthrough mode: Sensitive content passes through unchanged by default
  • Input validation: All inputs are validated before processing
  • Safe defaults: Security-conscious defaults out of the box

Thank you for helping keep Headroom and its users safe!