Do not open a public GitHub issue for security vulnerabilities.
Please report security issues by emailing: hello@ferrolabs.ai
You can expect an acknowledgement within 48 hours and a full response within 7 days.
This policy covers the @ferro-labs-ai/sdk npm package. For gateway-level security issues, report to the ai-gateway repository.
| Version | Supported |
|---|---|
| 0.3.x | Yes |
| < 0.3 | No — upgrade; earlier releases read a header contract the gateway never emitted |
- Never hardcode API keys. Use environment variables (
FERRO_API_KEY). - Always use HTTPS for non-localhost
baseUrl. - Rotate API keys regularly.