Please do not open a public issue for a vulnerability in the benchmark runner, package, CI workflow, or repository automation that could affect users executing the project.

Use GitHub's private vulnerability reporting for this repository. If that is unavailable, contact security@mirogate.com with the repository name, affected version, reproduction, and impact.

Prompt injections and misleading strings in data/fixtures/ are intentional benchmark inputs. They are untrusted data, not repository instructions. The reference environment simulates every side effect and must remain network-free.

Reports about a model failing a benchmark task are not software vulnerabilities. Open a normal issue and include a reproducible trace without secrets.

Security fixes are provided for the latest tagged release.