Security and Limitations

Security and Limitations

flowchart LR
  subgraph Local["Developer machine (trusted)"]
    CODE["Python script / notebook"]
    ENV["OS env / local .env (ignored by Git)"]
    RESULT["Local terminal / JSON results"]
    CODE --> RESULT
    ENV -. "credentials read" .-> CODE
  end
  subgraph External["Remote vendor boundary (only opt-in)"]
    API["Hosted OpenAI API"]
  end
  CODE -. "HTTPS requests, optional" .-> API
  subgraph GitHub["Public GitHub repository / wiki"]
    SRC["Source and documentation"]
  end
  CODE --> SRC
  NOTE["Never commit credentials or sensitive prompts"] -.-> SRC

Loading

Secure publication checklist

• Never commit .env, OPENAI_API_KEY, credentials, tokens, private prompts or sensitive notebook outputs.
• Review any newly generated results.json before public release; the .gitignore excludes it by default.
• --with-llm and model topics can send prompts and user text to a hosted API and incur charges.
• Keep GitHub source and Wiki separate: the Wiki is a distinct .wiki.git Git repository.

Current scope / non-features

This is not an MCP application, trading application, RAG engine, distributed worker, production chat server, or fully autonomous multi-agent framework. HR/IT simulations create text strings; they do not provision real corporate systems.

No external checkpoint store, persistent conversation database, model retries, structured telemetry, approval workflow, or secrets manager is implemented. The source is a developer tutorial, not a production security-reviewed deployment.