Lumbridge Compute — Apache-2.0

2026-08-03 23:47:51 -07:00
commit a8c8532105
40 changed files with 6101 additions and 0 deletions
@@ -0,0 +1,10 @@
+# Security policy
+
+Please report vulnerabilities privately to the maintainers before opening a
+public issue.
+
+Lumbridge Compute treats model registries as trusted local configuration and scenes/eval suites
+as potentially untrusted shared data. Shared manifests reference vetted ids and
+must never execute embedded shell commands. Downloads must be checksum-verified
+before promotion into the trusted registry. Secrets belong in environment or
+OS-managed secret stores, never manifests, logs, or result artifacts.