From ca316f082c577c1f7e8d9a923819d24564e3600c Mon Sep 17 00:00:00 2001
From: stuxf <70670632+stuxf@users.noreply.github.com>
Date: Tue, 31 Mar 2026 13:13:18 -0700
Subject: [PATCH] chore: update security.md (#24871)

---
 security.md | 34 ++++++++++++++++------------------
 1 file changed, 16 insertions(+), 18 deletions(-)

diff --git a/security.md b/security.md
index 76743b3af3..c6cd64ddaa 100644
--- a/security.md
+++ b/security.md
@@ -1,16 +1,15 @@
 # Data Privacy and Security
 
+
 ## Security Vulnerability Reporting Guidelines
 
 We value the security community's role in protecting our systems and users. To report a security vulnerability:
 
-- Email support@berri.ai with details
+- File a private vulnerability report on GitHub: [Report a vulnerability](https://github.com/BerriAI/litellm/security/advisories/new)
 - Include steps to reproduce the issue
 - Provide any relevant additional information
 
-We'll review all reports promptly.
-
-#### Vulnerability Categories
+### Vulnerability Categories
 
 We classify vulnerabilities into the following categories:
 
@@ -20,22 +19,31 @@ Attacks that compromise our CI/CD pipeline, allowing a malicious actor to point
 
 **P1: Unauthenticated Proxy Access**
 
-Application-level attacks where an unauthenticated user is able to gain access to a LiteLLM proxy instance that should be protected.
+Application-level attacks where an unauthenticated user is able to gain access to protected data on a LiteLLM proxy instance that should be protected (e.g api keys).
 
+**P2: Authenticated Malicious Actions**
 
-#### Bug Bounty Program
+Application-level attacks where an authenticated user is able to perform actions beyond their intended permissions, such as privilege escalation or unauthorized data access.
+
+### Bug Bounty Program
 
 We offer bounties for responsibly disclosed vulnerabilities based on severity:
 
+**Note that currently only P0/P1 reports are eligible for a bounty, though submissions for P2 bugs are still encouraged**
+
 | Severity | Bounty Range | Example |
 |----------|-------------|---------|
 | **Critical** | $1,500 - $3,000 | P0 supply chain compromise |
 | **High** | $500 - $1,500 | P1 unauthenticated proxy access |
-| **Medium** | $250 - $500 | P2 authenticated privilege escalation |
-| **Low** | $50 - $250 | Minor information disclosure, low-impact misconfigurations |
+| **Medium** | N/A | P2 authenticated privilege escalation |
+| **Low** | N/A | Minor information disclosure, low-impact misconfigurations |
 
 To qualify for a bounty, reports must include clear reproduction steps and must not involve systems or accounts you do not own. We review all submissions promptly and will follow up within 5 business days.
 
+### Known Non-Issues
+
+- Attacks that require a misconfiguration on setup (e.g not setting a `master_key` on the proxy configuration), are **explicitly not in scope** and are not considered vulnerable.
+
 ## Security Measures
 
 ### LiteLLM Github
@@ -68,13 +76,3 @@ LiteLLM supports the following data regions:
 - Europe, Frankfurt, Germany (AWS/GCP `eu-central-1`)
 
 All data, user accounts, and infrastructure are completely separated between these two regions
-
-### Security Vulnerability Reporting Guidelines
-
-We value the security community's role in protecting our systems and users. To report a security vulnerability:
-
-- File a private vulnerability report on GitHub: [Report a vulnerability](https://github.com/BerriAI/litellm/security/advisories/new)
-- Include steps to reproduce the issue
-- Provide any relevant additional information
-
-We'll review all reports promptly. Note that we don't currently offer a bug bounty program.