We take the security of Nover seriously. Nover is a thin HTTP client that never stores API keys, never sends data outside your configured gateway, and has no telemetry.

If you find a security issue, please report it privately — do not open a public issue. Contact the maintainer via GitHub at https://github.com/ChristopherDond/nover.

In-scope: this library's source, build configuration, and CI. Out-of-scope: the gateway you point Nover at (that's a separate project) and your configured provider credentials.

• No secrets in the client. An optional API key is read from the environment (NINEROUTER_KEY) and sent only to your gateway.
• No telemetry, no third-party data collection.
• Provider keys live in your gateway, on your machine/VM.
• Only httpx and typer as runtime dependencies.
• CI runs a secret-scanning test that fails the build on committed credentials.