Report security vulnerabilities privately through GitHub's private vulnerability reporting, not in a public issue. Include the version (cooker --version), what an attacker can do, and the steps to reproduce. Keep real keys, tokens and account files out of the report.

You can expect a response within one week. Fixes are included in a new release, and the advisory is published once users can update.

Only the latest release receives security fixes.

In scope: the cooker server, its Management API and the built-in dashboard. Examples include bypassing client-key or management-key checks, a credential or key leaking into logs or responses, and a request that reaches a provider with the wrong account.

Out of scope: a proxy deliberately exposed to the internet without access.api-keys, behaviour of the upstream providers, and problems in CLIProxyAPI itself (report those to router-for-me/CLIProxyAPI). Running it safely lists the settings a safe deployment needs.