From 5435858965d98047adc23a126f95ec6b45fd4ea3 Mon Sep 17 00:00:00 2001
From: ishaan-berri <155045088+ishaan-berri@users.noreply.github.com>
Date: Tue, 31 Mar 2026 10:23:31 -0700
Subject: [PATCH] Update security.md

---
 security.md | 44 +++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 39 insertions(+), 5 deletions(-)

diff --git a/security.md b/security.md
index 2da073661c..0788e2beb3 100644
--- a/security.md
+++ b/security.md
@@ -1,5 +1,44 @@
 # Data Privacy and Security
 
+## Security Vulnerability Reporting Guidelines
+
+We value the security community's role in protecting our systems and users. To report a security vulnerability:
+
+- Email support@berri.ai with details
+- Include steps to reproduce the issue
+- Provide any relevant additional information
+
+We'll review all reports promptly.
+
+#### Vulnerability Categories
+
+We classify vulnerabilities into the following categories:
+
+**P0: Supply Chain Attacks**
+
+Attacks that compromise our CI/CD pipeline, allowing a malicious actor to point our PyPI package or Docker images (GHCR or Docker Hub) to vulnerable or tampered artifacts.
+
+**P1: Unauthenticated Proxy Access**
+
+Application-level attacks where an unauthenticated user is able to gain access to a LiteLLM proxy instance that should be protected.
+
+**P2: Authenticated Malicious Actions**
+
+Application-level attacks where an authenticated user is able to perform actions beyond their intended permissions, such as privilege escalation or unauthorized data access.
+
+#### Bug Bounty Program
+
+We offer bounties for responsibly disclosed vulnerabilities based on severity:
+
+| Severity | Bounty Range | Example |
+|----------|-------------|---------|
+| **Critical** | $1,500 - $3,000 | P0 supply chain compromise |
+| **High** | $500 - $1,500 | P1 unauthenticated proxy access |
+| **Medium** | $250 - $500 | P2 authenticated privilege escalation |
+| **Low** | $50 - $250 | Minor information disclosure, low-impact misconfigurations |
+
+To qualify for a bounty, reports must include clear reproduction steps and must not involve systems or accounts you do not own. We review all submissions promptly and will follow up within 5 business days.
+
 ## Security Measures
 
 ### LiteLLM Github
@@ -12,11 +51,6 @@
 - For installation and configuration, see: [Self-hosting guided](https://docs.litellm.ai/docs/proxy/deploy)
 - **Telemetry** We run no telemetry when you self host LiteLLM
 
-
-:::info
-✨ SSO is free for up to 5 users. After that, an enterprise license is required. [Get Started with Enterprise here](https://www.litellm.ai/enterprise)
-:::
-
 ### LiteLLM Cloud
 
 - We encrypt all data stored using your `LITELLM_MASTER_KEY` and in transit using TLS.