vLLM 0.28

Apply the Python 3 prompt first. These rules target vLLM 0.28.0, including its Python API server, model loading, multimodal processing, adapters, tools, caches, and distributed workers.

Runtime and model artifacts

• Select the Python, PyTorch, and accelerator builds documented for the deployed backend. Package metadata accepts Python 3.10–3.14, but the GPU installation guide lists 3.10–3.13 and some prebuilt backends require 3.12; package acceptance alone does not establish hardware compatibility.
• Pin model, tokenizer, configuration, and adapter artifacts to reviewed immutable revisions. Set --revision, --tokenizer-revision, and, when relevant, --code-revision to commit IDs rather than mutable branches or tags.
• Keep --trust-remote-code disabled. If a model requires it, review the pinned model and processor code and isolate its execution from unrelated credentials and data; the flag is not a sandbox for models, dependencies, or plugins.
• Prefer --load-format safetensors for compatible reviewed models. The default auto loader can fall back to PyTorch checkpoint files; do not silently accept a different serialization format from untrusted storage.

Network and authentication

• Put an HTTPS gateway with authentication, authorization, and route-and-method allowlists in front of vLLM. Set --host to an explicit loopback/private address or use a protected --uds; prevent clients from reaching the backend port directly. An omitted host binds all interfaces.
• Configure VLLM_API_KEY or --api-key as an additional control. The 0.28.0 middleware checks