Add vLLM security policy

[syrull]

Summary

• add an open-source Mondoo vLLM Security policy
• cover the remote HTTP posture exposed by the new vllm provider: TLS, CORS, OpenAI-compatible route auth, non-/v1 inference routes, operational control routes, tokenization routes, docs/OpenAPI/version exposure, metrics/load exposure, and dev/profiler routes
• document that host-local checks such as CLI flags, LoRA state, model revision pinning, media allowlists, and internode controls are out of scope for the remote provider
• add the policy to the content README

Upstream dependency

• Depends on Add vLLM provider mql#7446 for the vllm provider and resources.
• This PR is draft until cnspec depends on an MQL build that includes that provider.

Validation

• git diff --check
• YAML parsed with yq
• verified 4 policy groups and 14 queries
• verified every group check UID has a matching query UID and no duplicate group check UIDs
• cnspec --auto-update=false policy fmt content/mondoo-vllm-security.mql.yaml --sort

Known blocker

• cnspec --auto-update=false policy lint content/mondoo-vllm-security.mql.yaml currently fails with cannot find resource for identifier 'vllm' because the provider is not available in this checkout's MQL dependency yet.

[github-actions]

@check-spelling-bot Report

🔴 Please review

See the 📂 files view, the 📜action log, or 📝 job summary for details.

Unrecognized words (2)

detokenize
vllm

To accept these unrecognized words as correct, you could run the following commands

... in a clone of the git@github.com:mondoohq/cnspec.git repository
on the syl/vllm-security-policy branch (ℹ️ how do I use this?):

curl -s -S -L 'https://raw.githubusercontent.com/check-spelling/check-spelling/cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c/apply.pl' |
perl - 'https://github.com/mondoohq/cnspec/actions/runs/25115911202/attempts/1' &&
git commit -m 'Update check-spelling metadata'

Available 📚 dictionaries could cover words (expected and unrecognized) not in the 📘 dictionary

This includes both expected items (629) from .github/actions/spelling/expect.txt and unrecognized words (2)

Dictionary	Entries	Covers	Uniquely
cspell:node/dict/node.txt	891	14	7
cspell:python/src/common/extra.txt	741	7	5
cspell:php/dict/php.txt	1689	13	4
cspell:fullstack/dict/fullstack.txt	419	4	4
cspell:python/src/python/python-lib.txt	2417	7	1

Consider adding them (in .github/workflows/spell-check.yaml) in jobs:/spelling: for uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c in its with to extra_dictionaries:

            cspell:node/dict/node.txt
            cspell:python/src/common/extra.txt
            cspell:php/dict/php.txt
            cspell:fullstack/dict/fullstack.txt
            cspell:python/src/python/python-lib.txt

To stop checking additional dictionaries, add (in .github/workflows/spell-check.yaml) for uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c in its with:

check_extra_dictionaries: ""

Warnings ⚠️ (1)

See the 📂 files view, the 📜action log, or 📝 job summary for details.

⚠️ Warnings	Count
⚠️ duplicate-pattern	5

See ⚠️ Event descriptions for more information.

If the flagged items are false positives

If items relate to a ...

• binary file (or some other file you wouldn't want to check at all).

  Please add a file path to the excludes.txt file matching the containing file.

  File paths are Perl 5 Regular Expressions - you can test yours before committing to verify it will match your files.

  ^ refers to the file's path from the root of the repository, so ^README\.md$ would exclude README.md (on whichever branch you're using).

• well-formed pattern.

  If you can write a pattern that would match it,
  try adding it to the patterns.txt file.

  Patterns are Perl 5 Regular Expressions - you can test yours before committing to verify it will match your lines.

  Note that patterns can't match multiline strings.

[github-actions]

Test Results

  1 files  ±0   38 suites  ±0   1m 20s ⏱️ +12s
709 tests ±0  708 ✅ ±0  1 💤 ±0  0 ❌ ±0 
710 runs  ±0  709 ✅ ±0  1 💤 ±0  0 ❌ ±0 

Results for commit f264d05. ± Comparison against base commit 9774557.