# Security policy

Report vulnerabilities privately through GitHub Security Advisories.

Inputs must contain pseudonymous SHA-256 commitments only. Do not submit names, email addresses, account ids, credentials, prompts, tool outputs or artifact bodies. The verifier performs no authentication, authorization, network access or subprocess execution. Filesystem writes are restricted to an explicit workspace-relative non-symlink artifact directory.