# Security policy

Please report vulnerabilities privately to the maintainers before opening a
public issue.

Lumbridge Compute treats model registries as trusted local configuration and scenes/eval suites
as potentially untrusted shared data. Shared manifests reference vetted ids and
must never execute embedded shell commands. Downloads must be checksum-verified
before promotion into the trusted registry. Secrets belong in environment or
OS-managed secret stores, never manifests, logs, or result artifacts.