AI Synth is intended for self-hosted or private-network deployments. The gateway forwards chat messages to configured upstream model endpoints and can expose those messages to every endpoint selected for a task.

Please do not open a public issue for an undisclosed vulnerability. Use the hosting platform's private vulnerability reporting feature or contact the maintainers privately.

Include, when possible:

• the affected file and version or commit;
• a clear description of the impact;
• reproduction steps or a minimal proof of concept;
• relevant configuration details with secrets removed; and
• a suggested mitigation.

You should receive an acknowledgement as soon as practical. Please allow time for investigation and remediation before making the report public.

• Set ORCHESTRATOR_API_KEY before exposing API endpoints outside a trusted network.
• Put the service behind TLS and a reverse proxy when accessed remotely.
• Keep config.json private and never commit upstream API keys.
• Restrict network access to configured model endpoints.
• Review logs and upstream model behavior before sending sensitive prompts.