# Security

Do not include credentials, private source or customer data in public issues.
For a security issue, use this repository's GitHub private vulnerability reporting
feature when enabled. If unavailable, open an issue asking for a private contact
without disclosing exploit details or sensitive data.

The installer runs with the caller's filesystem permissions. It reads bundled
instructions and writes project-local files; it does not execute workflow text,
call models, download scripts, start services or change global client settings.

Review dependency updates and generated diffs as code. Checksums detect drift;
they are not a signature or a guarantee against a malicious dependency. Use a
trusted, pinned release and keep the project in version control. Concurrent
writers and unexpected filesystem interruption are outside the installer's
transaction guarantees; see the architecture document for recovery.