If you discover a security vulnerability in OmniRoute, please report it responsibly:

1. DO NOT open a public GitHub issue
2. Use GitHub Security Advisories
3. Include: description, reproduction steps, and potential impact

OmniRoute implements a multi-layered security model:

Request → CORS → Authz pipeline (classify → policies → enforce)
       → Guardrails (PII masker, prompt injection, vision bridge)
       → Rate Limiter → Circuit Breaker → Cooldown → Model Lockout → Provider

All sensitive data stored in SQLite is encrypted using AES-256-GCM with scrypt key derivation:

• API keys, access tokens, refresh tokens, and ID tokens
• Versioned format: enc:v1:<iv>:<ciphertext>:<authTag>
• Passthrough mode (plaintext) when STORAGE_ENCRYPTION_KEY is not set

# Generate encryption key:
STORAGE_ENCRYPTION_KEY=$(openssl rand -hex 32)

OmniRoute ships a hot-reloadable guardrails registry (src/lib/guardrails/) with 3 built-in guardrails ordered by priority:

Custom guardrails register via registerGuardrail(new MyGuardrail()). The model is fail-open (exceptions never block traffic). Per-request opt-out via x-omniroute-disabled-guardrails header. → See docs/security/GUARDRAILS.md.

Middleware that detects and blocks prompt injection attacks in LLM requests:

Configure via dashboard (Settings → Security) or .env:

INPUT_SANITIZER_ENABLED=true
INPUT_SANITIZER_MODE=block    # warn | block | redact

Automatic detection and optional redaction of personally identifiable information:

PII_REDACTION_ENABLED=true

All secrets must be set before starting the server. The server will fail fast if they are missing or weak.

# REQUIRED — server will not start without these:
JWT_SECRET=$(openssl rand -base64 48)     # min 32 chars
API_KEY_SECRET=$(openssl rand -hex 32)    # min 16 chars

# RECOMMENDED — enables encryption at rest:
STORAGE_ENCRYPTION_KEY=$(openssl rand -hex 32)

The server actively rejects known-weak values like changeme, secret, or password.

• Use non-root user in production
• Mount secrets as read-only volumes
• Never copy .env files into Docker images
• Use .dockerignore to exclude sensitive files
• Set AUTH_COOKIE_SECURE=true when behind HTTPS

docker run -d \
  --name omniroute \
  --restart unless-stopped \
  --read-only \
  -p 20128:20128 \
  -v omniroute-data:/app/data \
  -e JWT_SECRET="$(openssl rand -base64 48)" \
  -e API_KEY_SECRET="$(openssl rand -hex 32)" \
  -e STORAGE_ENCRYPTION_KEY="$(openssl rand -hex 32)" \
  diegosouzapw/omniroute:latest

• Run npm audit regularly (npm run audit:deps covers main + electron)
• Keep dependencies updated
• The project uses husky + lint-staged for pre-commit checks (lint-staged + check-docs-sync + check:any-budget:t11)
• CI pipeline runs ESLint security rules on every push (no-eval, no-implied-eval, no-new-func = error)
• Provider constants validated at module load via Zod (src/shared/validation/schemas.ts)
• Secure-by-default libraries used: dompurify / isomorphic-dompurify (XSS), jose (JWT), better-sqlite3 (no SQLi risk via parameterized queries), bcryptjs (password hashing)

These rules are enforced by tooling and reviewers:

1. Never commit secrets — .env is gitignored; .env.example is the template (no literals, comments only — see PUBLIC_CREDS.md below)
2. Never use eval(), new Function(), or implied eval — ESLint enforces
3. Never bypass Husky hooks (--no-verify, --no-gpg-sign) without explicit operator approval
4. Never write raw SQL in routes — always go through src/lib/db/ (parameterized)
5. Always validate inputs with Zod — src/shared/validation/schemas.ts
6. Always sanitize upstream headers — denylist in src/shared/constants/upstreamHeaders.ts
7. Encrypt credentials at rest — AES-256-GCM via src/lib/db/encryption.ts
8. Public upstream OAuth identifiers via resolvePublicCred() — never embed AIza… / GOCSPX-… / …apps.googleusercontent.com literals in source. See docs/security/PUBLIC_CREDS.md.
9. Error responses through buildErrorBody() / sanitizeErrorMessage() — never put raw err.stack / err.message in HTTP / SSE / executor / MCP response bodies. See docs/security/ERROR_SANITIZATION.md.
10. exec() / spawn() runtime values via the env option — never string-interpolate external paths or untrusted values into shell-passed scripts. Reference: src/mitm/cert/install.ts::updateNssDatabases.
11. Prefer secure-by-default libraries — see tldrsec/awesome-secure-defaults (Helmet.js, DOMPurify, ssrf-req-filter, safe-regex, Google Tink). Reach for them before rolling your own.

• docs/architecture/AUTHZ_GUIDE.md — authorization pipeline
• docs/security/GUARDRAILS.md — guardrails framework
• docs/security/COMPLIANCE.md — audit log and retention
• docs/security/PUBLIC_CREDS.md — mandatory pattern for public upstream credentials
• docs/security/ERROR_SANITIZATION.md — mandatory pattern for error responses
• docs/architecture/RESILIENCE_GUIDE.md — circuit breaker + cooldown + lockout
• docs/security/STEALTH_GUIDE.md — TLS fingerprinting (legal/ethical notice)
• CLAUDE.md — hard rules for AI agents
• tldrsec/awesome-secure-defaults — curated secure-by-default libraries