Reporting a security issue

Orch Engine handles prompts, model traffic and provider API keys, so security reports get priority.

How to report

Email security@bairavs.com, or use GitHub's Report a vulnerability on the repository. Please don't open a public issue for a vulnerability.

Include what you found, how to reproduce it, and the version (bairav version).

Reports are read by the maintainer, Mohan Raj Ravi.

What happens next

• An acknowledgement within 3 days.
• A fix or a plan within 14 days for confirmed issues.
• Credit in the release notes, unless you'd rather stay anonymous.

In scope

The bairav CLI, the operator, the DLP proxy and gateway, and the published container images. DLP bypasses count: sensitive data reaching a model or provider when a policy says it shouldn't.

How DLP works

For what the DLP engine detects, how it handles obfuscated text and streams, and its known limits, see How DLP works.

Supported versions: the latest release. The full policy is also in SECURITY.md.