Public security fixes target the current main branch until tagged releases are established. After v0.1.0, supported release lines will be listed here.

Please do not open a public issue for a suspected secret leak, redaction bypass, credential exposure, or provider billing flaw.

Report privately by emailing [email protected] with:

• A short description of the issue.
• Steps to reproduce with dummy data.
• Affected files, commands, or configuration.
• Whether the issue can cause data exfiltration, unsafe routing, or unexpected spend.

We will acknowledge receipt when possible and coordinate a fix before public disclosure.

fleet-fuse is designed to fail closed:

• high sensitivity routes only to configured first-party local CLIs.
• External pools require --enable-external and an allowed sensitivity tier.
• Payloads sent to external pools pass through fleet_scrub.py.
• If redaction leaves a high-severity residual secret, the external subtask is blocked.

This is not a substitute for reviewing the data you send to any model provider. Treat external engines as third-party processors unless their own terms and your configuration say otherwise.

External pools can consume paid provider quota when explicitly enabled. FleetFuse requires --yes-metered or an interactive YES before live metered routes, supports local monthly caps, and records local disable markers after terminal budget/quota/auth errors. These are safeguards, not provider billing guarantees. Users remain responsible for API keys, provider-side limits, model selection, token usage, agent fan-out, retries, and all resulting spend.

• Store real keys in ~/.config/fleet-fuse/env or environment variables, not in the repository.
• Keep .env.example as placeholders only.
• Rotate any key that appears in commits, logs, screenshots, issues, or support requests.
• Use low monthly caps for billed pools until your setup has been smoke-tested.