AIProxy is under active development and does not currently have formal security support windows or backport guarantees.
Security fixes will be handled on a best-effort basis in the main development line.
Please do not open public issues for suspected vulnerabilities that could expose users, credentials, or local systems.
Instead:
- contact the maintainers privately if a private channel exists
- if no private channel is available yet, open a minimal issue requesting a secure reporting path without disclosing exploit details
Include:
- a clear description of the issue
- affected versions or commit range if known
- reproduction steps
- impact assessment
- any suggested mitigation
Please be especially careful around:
- credential handling
- keyring integration
- helper token generation and validation
- proxy authentication
- launcher behavior and generated settings
- any experimental Codex/ChatGPT auth behavior
- the supported auth path is OpenAI API key based
- the Codex/ChatGPT auth path is experimental and intentionally limited
- the project does not implement undocumented OAuth refresh behavior
- contributors should avoid expanding the experimental auth surface without corresponding design documentation