Security and integrity fixes are applied to the current 0.3.x development line. Frozen historical revisions remain reproducible but may not receive backports.

The PhysTwinCase directory adapter still needs the official dataset's historical calibrate.pkl and processed_masks.pkl files. Prob4D loads these only inside that dedicated legacy adapter, rejects symbolic-link substitution, and uses a restricted unpickler that admits primitive containers plus the minimal NumPy array-reconstruction globals. Arbitrary Python globals fail closed. Portable Prob4D prediction, calibration, observation, and evidence artifacts never use pickle.

The restriction prevents ordinary pickle code execution through those two adapter paths; it is not a general sandbox against malformed or resource-exhausting files. Use only locally verified official dataset files and retain their hashes in claim-bearing run provenance. Other explicitly diagnostic legacy import paths remain trusted-input boundaries unless their own contract states otherwise.

Ordinary pull-request workflows run on GitHub-hosted infrastructure. Pull-request source, branch names, and workflow inputs must not select or trigger a persistent self-hosted runner.

The only approved path for executing reviewed pull-request source on a self-hosted runner is the manual Trusted exact-head validation workflow. It must be dispatched from main, verify an open same-repository pull request and its exact current 40-character head SHA on a hosted runner, and use the protected trusted-self-hosted-validation environment before checkout on the self-hosted host. The environment must have an independent required reviewer and no attached secrets or write credentials. See docs/trusted-self-hosted-validation.md for the complete operational and host-hardening requirements. Repository setup and acceptance testing are tracked in issue #157.

Environment approval is not a sandbox. Suspected access to unrelated runner files, credentials, datasets, services, or network resources is a security incident even when repository and workflow permissions were read-only.

The repository runs pinned CodeQL analysis for Python and GitHub Actions plus a strict, pinned pip-audit dependency scan on pull requests, default-branch pushes, a weekly schedule, and explicit dispatch. Workflow-policy tests require immutable action pins, disabled checkout credential persistence, and the protected self-hosted boundary.

Do not open a public issue for a suspected vulnerability involving credential exposure, artifact path traversal, unsafe deserialization, workflow privilege, model-source integrity, evidence tampering, or self-hosted runner access.

Use GitHub's private vulnerability-reporting or Security Advisory interface for this repository. Include the affected revision, a minimal reproduction, the expected security boundary, and whether any private data, token, model artifact, or evidence bundle may have been exposed. If private reporting is unavailable, contact the repository maintainers through a private institutional channel.

The maintainers will acknowledge the report, assess affected versions and artifacts, and coordinate a fix and disclosure. Scientific correctness concerns without a security impact should use an ordinary issue and retain the repository's explicit claim boundaries.