The latest published 0.x release receives security fixes.
Please report security issues privately rather than opening a public issue.
- Use GitHub's private vulnerability reporting, or
- Email sebastian@0a.cl with the details.
Include a description, a reproduction, and the impact. You can expect an initial response within a few days. Once a fix is released, we are happy to credit you in the advisory unless you prefer to remain anonymous.
llm-sse has zero runtime dependencies and performs only in-memory parsing
of streamed text: it does not make network requests, read or write files, or
execute code from its input. The most relevant risks are denial of service from
pathological input (for example, unbounded buffering on a stream with no event
delimiters). Reports along those lines are welcome.