Do not open a public issue for a suspected vulnerability, accidental sensitive-data exposure, production-boundary bypass, or fabricated action success. Use GitHub private vulnerability reporting for this repository. If that channel is unavailable, contact the repository owner privately through their GitHub profile before sharing details.

• Real or plausibly real patient information.
• Authentication secrets, API keys, certificates, or signing material.
• Production endpoints, device identifiers, account identifiers, or operational logs.
• Production administration commands or unrestricted native/browser bridges.
• Model weights without an explicit license and provenance review.

Until 1.0.0, only the latest commit on the default branch receives security fixes.

The model is an untrusted proposer. The host validates schemas, capability, effect, deadlines, and results. Tool annotations and prompt instructions are not authorization. The simulator binds to loopback and contains synthetic fixtures only.