inferock-bench touches provider keys, so security reports get a private path first.

Use this page when a vulnerability could expose keys, route requests incorrectly, bypass local auth, or make public export artifacts differ from reviewed source. Billing disputes and provider-side outages belong in the benchmark evidence path, not the private vulnerability path.

Please do not open a public issue for an unpatched vulnerability. For a private channel, open a private GitHub Security Advisory on the public repo (Security → Advisories → Report a vulnerability) — this keeps the report and our back-and-forth private until a fix ships. Email security@opiusai.com (subject inferock-bench security report) is equally fine if you prefer.

Please include:

• The affected package, version, commit, or npm tag.
• The smallest reproduction you can share without provider keys, prompts, raw responses, customer data, or internal endpoints.
• What you believe an attacker can read, write, send, or bypass.
• Whether the issue affects the local benchmark, @inferock/measure, The Inferock Standard, or the export pipeline.

We support the latest public inferock-bench release and the current generated public repo. Older releases are best-effort unless the fix is small and the risk is high.

This is a small team. We prioritize high-risk key or request-routing issues first and keep you updated when there is a meaningful change. That is a best-effort support policy, not a paid SLA.

We practice coordinated disclosure. When you report privately, we will work out a disclosure timing with you rather than race to publish, and we will credit you in the advisory and release notes unless you would rather we did not. If a vulnerability is being actively exploited we may need to publish and patch quickly, and we will tell you. We are a small team and do not commit to a fixed response clock. We prioritize key-handling and request-routing issues first and will keep you updated as there is meaningful progress.

In scope:

• Provider-key storage or masking bugs in inferock-bench.
• Local bench-key bypasses that let another local client use your configured provider key.
• Request routing bugs that send traffic somewhere other than the configured provider endpoint.
• Reliability-index or receipt behavior that sends more data than the docs say.
• Export or package-integrity bugs that could make the public repo differ from the reviewed source.

Out of scope:

• Attacks that require control of the user's machine, shell, browser profile, package manager, or npm install path.
• Provider-side logging, retention, billing, outage, or model behavior.
• Social engineering, spam, denial-of-service against public OpiusAI or provider infrastructure, or testing against other users.

There is no bug bounty program right now. We still want the report.

• What leaves your machine for the documented network and file boundaries.
• Key handling for provider keys, local ibl_ keys, masking, and rotation.
• Threat model for the local benchmark's stated limits.