fx-bridge is a loopback-only compatibility service. It handles provider credentials, complete model prompts, source code, tool results, and model-generated tool arguments. Do not expose it to a LAN or the public internet.

Security fixes are applied to the latest release. Because fx's override and wire protocol are experimental, compatibility is tested against explicitly documented fx versions rather than guaranteed indefinitely.

Use GitHub's private vulnerability reporting feature when enabled. Otherwise, contact the maintainer privately before opening a public issue.

Do not include API keys, private upstream URLs, raw FXB_DUMP files, source code, or unsanitized logs. A useful report includes:

• fx and fx-bridge versions;
• operating system and Python version;
• a minimal synthetic request or stream fixture;
• expected and actual behavior;
• security impact.

• The server binds to 127.0.0.1 only.
• Requests carrying an Origin header or a non-loopback Host header are rejected, blocking browser drive-by requests and DNS rebinding.
• Remote upstreams must use HTTPS; plaintext HTTP is limited to loopback inference servers.
• Credentials in URL user-info are rejected.
• Environment-provided API keys take precedence over literal config keys.
• Request bodies are bounded and validated.
• Malformed tool arguments and truncated upstream streams fail closed.
• Debug request dumps are created with mode 0600 but remain sensitive and should be deleted after use.

fx-bridge does not sandbox model-generated tools. Tool authorization and execution remain the responsibility of fx.