Report vulnerabilities privately through GitHub private vulnerability reporting. Do not open a public issue.

Include the cyllama version, platform and wheel variant (cyllama info), and steps to reproduce.

Fixes land in the latest release only.

In scope:

• The Cython bindings and helper C/C++ code under src/cyllama/.

• The OpenAI-compatible servers, EmbeddedServer and PythonServer.

• Wheel packaging, including bundled shared libraries.

Report vulnerabilities in llama.cpp, whisper.cpp, stable-diffusion.cpp, cpp-httplib or sqlite-vector upstream. Tell us too if a cyllama release ships the affected version.

• Both servers bind 127.0.0.1 by default and have no TLS.

• Binding another address without an API key lets anyone who can reach the port use the model. See Authentication and Limits.

• Model files (GGUF, safetensors) are parsed by native code. Load models only from sources you trust.