Stoke / Security
Security
Stoke is designed to keep the gateway on the request path and Ollama on loopback. The source is open so the security boundary can be inspected.
Report a vulnerability
Please use GitHub's private vulnerability reporting flow rather than posting credentials, exploit details, or sensitive configuration in a public issue.
Report privately on GitHubSecurity properties
- Authentication is fail-closed unless local development mode is explicitly enabled.
- Ollama can remain bound to
127.0.0.1; Stoke is the authenticated network door. - Budget, rate, and loop checks run before a provider call.
Read the architecture and the repository's security invariants.