Use GitHub's private vulnerability reporting for sensitive findings. If that route is unavailable, email info@mikesoft.it with the subject Hermes Chutes Provider Security Report. Do not disclose API keys, credentials, private prompts, or account data in a public issue.

For non-sensitive security hardening, open an issue with the affected component, observed behavior, impact, and a minimal reproduction where practical.

Security fixes target the latest published release and the current main branch.

This project must never log, persist, or commit Chutes API keys. Local credentials belong in the active Hermes profile's ignored environment configuration.