QuickRouter is designed with strict security isolation:

1. Strict Secrets Isolation (.env):

   • API keys and private URLs are loaded exclusively from .env or system environment variables.
   • .env is permanently excluded from Git tracking in .gitignore.
   • The CLI and API strictly reject reading .env files as prompt inputs (validate_safe_path).

2. Secret Masking:

   • All logs, debug traces, and console dumps mask API tokens (e.g. sk-1...cdef or [PLACEHOLDER]).
   • Plaintext credentials are never exposed in terminal streams or log handlers.

3. Path Traversal Protection:

   • File input paths (-f / --file) are canonicalized and checked for safe boundaries.

4. Security Audit Command:

   • Run python router.py --audit or quickrouter --audit at any time to verify secret isolation and Git ignore status.

If you discover a potential security vulnerability within QuickRouter, please do not open a public issue. Instead, report it via email to tiyatrotist@gmail.com.