LiteLLM 1.105

Use these rules for LiteLLM 1.105 SDK calls, the AI gateway, and applications invoking its agent and Decisions APIs. Enforce application permissions at the boundary where an effect occurs, including after LiteLLM has routed a request.

Service configuration

• Choose a security-supported CPython minor in the package's >=3.10,<3.15 range, and test required extras on it. Treat PyPI packages and container images as separate artifacts; verify image signatures with the trusted release key and deploy a reviewed digest.
• Require a random protected LITELLM_MASTER_KEY and keep the dangerous weak-key override disabled. Give inference applications separate virtual keys; preserve LITELLM_SALT_KEY and follow the documented re-encryption path when rotating a master key that protects database credentials.
• Keep database migration checks fail closed. A proxy that cannot establish the expected schema must not accept inference, key-management, or spend traffic. Give migration jobs and runtime replicas different database privileges.

Access control

• Issue virtual keys with explicit allowed models, routes, object permissions, expiry, and key/team budgets. Do not interpret an empty model list as deny-all or let a proxy-admin key serve as a tenant key; test aliases, native provider routes, and object APIs against effective grants.
• Configure JWT issuer, audience, and trusted JWKS independently of token claims. Map only verified identity and team claims, then test blocked, expired, wrong-audience, and cross-team credentials through every route family.
• In custom