If you discover a security vulnerability in llmcall, please report it responsibly:

1. Do not open a public GitHub issue.
2. Email hello@ndamulelo.co.za with a description of the vulnerability, steps to reproduce, and any relevant logs or screenshots.
3. You will receive an acknowledgment within 48 hours.

llmcall depends on LiteLLM, which experienced a supply chain incident in March 2026. As a precaution:

• We explicitly exclude the compromised LiteLLM versions (1.82.7, 1.82.8) in our dependency specification.
• We pin all CI/CD GitHub Actions to commit SHAs, not mutable tags.
• We run pip-audit in CI to catch known vulnerabilities in our dependency tree.
• Dependabot monitors our dependencies weekly.