structllm is pre-1.0. Security fixes are applied to the latest minor release only.
| Version | Supported |
|---|---|
| 0.1.x | ✅ |
| < 0.1 | ❌ |
Please do not open a public GitHub issue for security problems.
Email the maintainer directly at the address listed in the GitHub profile with:
- A description of the issue and its impact.
- Steps to reproduce, or a proof-of-concept.
- Any suggested mitigation if you have one.
You can expect an initial response within 7 days. Once the issue is confirmed, a fix will be prepared in a private branch, released as a patch version, and publicly disclosed in the release notes.
structllm is a client-side library: it has no network listeners and stores no credentials of its own. Reports we're most interested in:
- Schema generation or validation logic that lets malformed input crash a caller's program or bypass validation.
- JSON repair logic that mishandles untrusted input.
- Provider adapters that mishandle credentials or leak them in error messages or logs.
Out of scope:
- Issues in upstream provider SDKs (report those to the SDK maintainers).
- Hallucinations or misbehavior of the underlying LLMs.