Set a boundary you can verify.

Report privately

Please do not open a public issue for a suspected vulnerability. Use GitHub’s private reporting flow or email security@omniswitch.dev. Include the impact, reproduction steps, affected version or commit, and any suggested remediation. Do not send production credentials.

Supported versions

The product security policy defines these support boundaries. The v0.2.0 release is not assumed to be published by this page.

Response targets

These are the targets in the product’s coordinated-disclosure policy, not a service-level agreement.

Before exposing a gateway

• Enable gateway authentication; replace the bootstrap key with a personal admin key.
• Scope gateway keys by role and workspace. Set budgets and request limits.
• Keep provider secrets in environment variables or the provider vault, not checked-in YAML.
• Leave payload logging off unless an explicit debugging need justifies it.
• Use API-key-scoped caching; global scope can mix tenant-independent content by design.
• Terminate TLS, restrict ingress, back up your data, and review retention before upgrading.
• Verify release signatures and attestations when the signed v0.2.0 artifacts are published.

gateway:\n  auth: true\n  cache_scope: api_key\n  log_payloads: false

Know the scope

The policy documents operator-selected insecure modes—authentication off, global caching, payload logging, or existing host/process access—as distinct from an unexpected security bypass. Report a way to trigger those behaviors without the operator’s opt-in.