View Source Security policy

Please report suspected vulnerabilities privately to the maintainers before opening a public issue. Do not include API keys, prompts, customer payloads, or provider response bodies in a report.

The observer is designed to keep generated text and complete provider bodies out of its snapshot. It is not a transport, authentication, logging, billing, or retry system. Applications must still bound their own buffers and protect their request identifiers and credentials.