Security fixes are released for the latest minor version.

Please do not open a public issue. Report privately through GitHub security advisories. You should get an acknowledgement within a few days. Please include a description, the affected version and, if you can, a minimal reproduction.

• surestream sits between your code and a stream you already opened. It never opens connections on its own (except surestream.testing), never reads credentials, and has no runtime dependencies.
• resumable() re-sends your request, including the partial model output, to the endpoint your make_request callable talks to. It adds no destination of its own.
• surestream.testing.FakeLLMServer and CutProxy are test tools. They bind to 127.0.0.1 by default, have no authentication, and must not be exposed to untrusted networks.