# Security policy

Report vulnerabilities privately to **security@karti.ai** before opening a
public issue. Expect an acknowledgement within a few days.

## Scope you should assume

Compute is a node-local supervisor, and two properties are deliberate rather
than oversights — know them before you deploy it:

- **The gateway has no authentication and no TLS.** The shipped systemd unit
  binds `127.0.0.1`. Anything that widens that bind publishes every model on the
  node; put a reverse proxy or an overlay network in front instead.
- **The model registry is trusted local configuration.** Launch commands live
  only in the registry, never in a Scene, so a Scene obtained from elsewhere
  cannot introduce code. Treat the registry itself as you would a systemd unit.

Lumbridge Compute treats model registries as trusted local configuration and scenes/eval suites
as potentially untrusted shared data. Shared manifests reference vetted ids and
must never execute embedded shell commands. Downloads must be checksum-verified
before promotion into the trusted registry. Secrets belong in environment or
OS-managed secret stores, never manifests, logs, or result artifacts.