LexiGrade accepts short text inputs and deserializes a local scikit-learn model. The published service is a research example and does not provide authentication, authorization, abuse prevention, TLS termination, or production rate limiting.

• Never load an untrusted .joblib or pickle file. Deserialization can execute arbitrary code. Use the model bundled with an official wheel or a model you trained yourself.
• If LEXIGRADE_MODEL_PATH points to an external artifact, verify its origin and checksum before starting the API.
• Put any Internet-facing deployment behind authentication, request-size limits, rate limiting, TLS, logging controls, and normal infrastructure monitoring.
• Treat MLflow, W&B, container-registry, and cloud credentials as secrets.
• Never commit .env files, tokens, learner data, private datasets, source documents, or machine-specific paths.
• Keep Python and all direct and transitive dependencies patched.

The public v2 dataset is derived from lexical database material and is not intended to contain personal data. Please report an unexpected personal-data or licensing issue privately as well.

Report suspected vulnerabilities privately to the repository owner through the contact method on the GitHub profile. Do not open a public issue containing credentials, personal data, or exploit details.