Provider-Aware Statusline contains documentation and tooling around LLM routing gateways (such as OmniRoute) and Claude Code. The statusline is read-only: it reads the session transcript and a model→provider mapping file, and never writes, never calls the gateway, and never makes network requests.

• Never reads, logs, or displays tokens, prompts, request bodies, or API keys.
• Never reads .claude/settings.local.json (which contains your live gateway token) or OmniRoute server.env.
• Never writes to the OmniRoute data volume or any of its tables.
• Model and provider strings are rendered as display data only — never parsed, executed, or treated as instructions.

If you believe any of these invariants can be violated, report it.

Please do not open a public issue for security problems. Instead, report by opening a GitHub issue marked security, or email the maintainer directly through the contact shown on the GitHub profile. You should receive a response within 7 days.

Please include:

• A description of the issue and how to reproduce it
• Which invariant you believe is violated, if any
• Impact and any suggested mitigation

The following are not in scope and are expected behavior:

• A gateway operator intentionally mislabels a provider/model — the statusline displays labels as data; correctness of the upstream label is the gateway's responsibility.
• A missing or stale empirical mapping — the statusline degrades to model-only.
• The live token living in your local .claude/settings.local.json — keep that file out of any repository, backup, or archive (it is gitignored here).

We ask that you give us a reasonable window to fix before public disclosure, and that you do not test against other people's infrastructure.