DriftWatch is currently in alpha. Only the latest minor release receives security fixes.

Please do not open a public issue for security bugs.

The preferred channel is GitHub's private vulnerability reporting:

1. Go to the Security tab of this repository.
2. Click Report a vulnerability.
3. Fill out the form. You will get an acknowledgement within 72 hours.

If GitHub Security Advisories are not available to you, you can also reach the maintainers by opening a draft pull request that demonstrates the issue against a private fork and emailing the link to the maintainer listed in the repository profile.

A useful report contains:

• The affected version (commit SHA, release tag, or master@<date>)
• A description of the vulnerability and its impact
• Steps to reproduce (a minimal proof-of-concept is ideal)
• Any suggested remediation if you have one

1. Acknowledgement — within 72 hours of receipt.
2. Triage — within 7 days we will confirm whether we accept the report and an estimated severity.
3. Fix and disclosure — we aim to ship a patched release within 30 days of confirmation for high-severity issues and 90 days for everything else. Coordinated disclosure is preferred; we will work with you on a public-disclosure timeline.
4. Credit — with your permission we will credit you in the release notes and the GitHub Security Advisory.

In scope:

• The web application in web/
• Server-side code that runs as part of the production Docker Compose stack
• Authentication, session, and RLS handling
• The ScoreRift scoring code in ray_scorer_prototype.py
• Build and CI pipeline configuration

Out of scope:

• The separate biged-rs service (optional integration — report there directly)
• Third-party model hosts (vLLM, LiteLLM, llama.cpp, TGI) — report upstream; we track advisories and update pins
• Third-party dependencies — please report upstream first; we will track and roll forward
• Issues that require a compromised local environment to exploit
• Findings against default development credentials (changeme, devpassword) — these are documented as unsafe defaults and the README warns against shipping them

DriftWatch nodes talk to an OpenAI-compatible model host (vLLM by default). The host serves model inference only, but it is still a network service handling tenant-derived prompt data — treat it accordingly:

• Never expose the model host publicly. vLLM, LiteLLM, llama.cpp, and TGI ports stay on the internal Docker network (expose, not ports). Caddy is the only public listener.
• Always set an API key. INFERENCE_API_KEY maps to vLLM --api-key and llama.cpp --api-key. Note vLLM's key check covers only /v1-prefixed routes — its operational endpoints are unauthenticated, which is why the internal-network rule above is not optional. TGI has no native key auth; front it with Caddy.
• Pin LiteLLM and patch fast. LiteLLM's 2026 advisories — CVE-2026-42208 (pre-auth SQL injection in key verification, exploited in the wild within ~36 hours of disclosure) and CVE-2026-42271 (MCP server preview command injection, CISA KEV, chains to unauthenticated RCE) — were fixed in v1.83.7+; run >= v1.83.10-stable, set a strong LITELLM_MASTER_KEY, and leave the MCP preview endpoints disabled.
• Treat model weights as code. Only pull models from trusted registries; vLLM loads from the Hugging Face cache volume, so restrict who can write to it.