Security

Security

Public inputs reject coercion, non-finite numbers, negative zero, excessive depth, oversized files, excessive JSONL lines, and unsafe YAML aliases.

Operation security includes digest binding, expiry, nonce replay protection, signer independence, secret redaction, SSRF controls, redirect denial, fixed process binaries, symlink checks, timeouts, byte limits, and fail-closed crash reconciliation.

Never place private keys or provider credentials in plans, reports, examples, issues, or logs.

The v1.1.0 wheel, source distribution, schema bundle, provenance manifest, and two SBOM formats are attached to the GitHub release. PyPI is published through Trusted Publishing. Verify exact versions in production and review residuals before promotion.