Only the latest minor release receives security fixes. There is no LTS branch.

If you find a security issue, please do not open a public GitHub issue. Email matben32@gmail.com with:

• A description of the issue and the affected version.
• Steps to reproduce, or a minimal proof of concept.
• Any logs or context that help reproduce locally.

You can expect a first reply within a few business days. Fixes will be coordinated privately and disclosed in the release notes once a patched version is published.

vllmops spawns local processes, reads YAML configuration from the project workspace and scrapes /metrics from servers it started. It does not bind network sockets itself, does not authenticate users and does not store credentials beyond what the user puts in .env files.

Out of scope for security reports:

• Misuse of vLLM itself (those belong upstream).
• Security of the model weights or the data served through them.
• Permission issues caused by running the CLI as root or with custom umasks.