Security fixes are provided for the latest released version of ruby_llm-voyage.

Please do not open a public issue for a suspected vulnerability. Use GitHub private vulnerability reporting to report it privately.

Include:

• The affected version
• Reproduction steps or a minimal proof of concept
• The potential impact
• Any suggested mitigation

Do not include real Voyage API keys, customer embedding inputs, or production responses. You should receive an acknowledgement within seven days.

• Store VOYAGE_API_KEY in a secret manager or environment variable.
• Never expose the API key to browsers or other untrusted clients.
• Only configure voyage_api_base from trusted application configuration.
• Treat embedding inputs and vectors as potentially sensitive data.
• Review RubyLLM instrumentation exporters before sending event payloads to a third party; events can contain embedding text or reranking queries.