Private Registry access for OSS users

[ojensen-berri]

We just published Introducing the LiteLLM Private Registry. For the most severe vulnerabilities, we plan to send fixes privately first, so organizations have time to upgrade before the patch and advisory go public. All security fixes will still be released publicly.

Our pilot covered only enterprise customers. As we design the process for a permanent private registry, we want to include OSS users too, but we have to do it in a vetted way. This discussion is where we want to work that out with you.

Anyone can run LiteLLM, so running it can't be the bar for access. What we need is real accountability if someone abuses the access. We would like to hear what you think that should look like, and what you could reasonably provide or commit to in exchange for early access. If other open source projects you depend on handle this well, please tell us which ones.

Please share your thoughts below.