Security

The gateway sits in your request path and near your keys, so its defaults are conservative. Here's exactly what it does and doesn't do.

What it protects by default

• Your API keys pass through to the provider unchanged and are never written to the telemetry log.
• No prompt or response bodies are stored - only metadata (model, tokens, cost, latency, status, project). On a failed request a short upstream error message (truncated to 300 chars) is recorded to aid debugging, but never request or response content.
• Cross-origin protection. The gateway accepts browser requests only from its own origin or origins you list in allowedOrigins. A random web page you happen to visit cannot spend your keys through the proxy or wipe your telemetry. Server-side callers (no Origin header) are unaffected.
• Central keys are never handed to untrusted cross-origin callers - closing the “confused deputy” hole where a page could bill your account.
• Auth is on by default: open until the first admin exists, then dashboard/API require a session and the proxy requires a per-project gateway key.

Allowing a browser app

If a web frontend must call the gateway directly from the browser, allowlist its origin:

"allowedOrigins": ["https://app.example.com"]

Hardening for shared / production use

• Keep the default 127.0.0.1 bind, or put the gateway behind a VPN or TLS reverse proxy if exposed.
• Create the admin account immediately - don't leave open setup mode on a shared network.
• Rotate a project's gateway key if it may have leaked (Settings → Projects).
• Auth is username/password + signed cookies today (no SSO), and telemetry is not encrypted at rest - appropriate for an internal tool; review before external multi-tenant exposure.

Reporting a vulnerability

Please report privately via GitHub's “Report a vulnerability” button on the repo's Security tab rather than a public issue. Details are in SECURITY.md.