Skip to content

Security: wxstdo-boop/grokroute

Security

SECURITY.md

Security Policy

πŸ”’ How GrokRoute Keeps You Safe

GrokRoute is a local proxy β€” it runs entirely on your machine at 127.0.0.1:8083.

  • βœ… Your prompts never touch our servers β€” we don't have any servers
  • βœ… API keys are stored locally in ~/.grokroute/grokroute-config.json
  • βœ… No telemetry, no tracking, no analytics
  • βœ… TLS verification can be disabled for local/test environments only

What Leaves Your Machine

Only the chat requests you make go to the AI provider you configure (Groq, Agnes, Zhipu, Laguna, or local Ollama). GrokRoute does not intercept, log, or store your data.

Reporting a Vulnerability

Found a security issue? Please do not open a public GitHub issue.

Instead, report it privately:

  1. Email: security@grokroute.dev (or open a private vulnerability report on GitHub)
  2. Expect a response within 48 hours
  3. We'll work with you to validate and fix the issue
  4. You'll be credited in the release notes (unless you prefer anonymity)

Supported Versions

Version Supported
2.x βœ… Active
1.x ❌ EOL
< 1.0 ❌ EOL

Best Practices

  • πŸ” Never commit grokroute-config.json to version control
  • πŸ” Use environment variables for CI/CD: GROQ_API_KEY, AGNES_API_KEY, etc.
  • πŸ” Rotate API keys periodically
  • πŸ” Run behind a firewall β€” the proxy binds to 127.0.0.1 by default (localhost only)

GrokRoute is MIT licensed. Use it freely, securely, and responsibly.

There aren't any published security advisories