This repo is a design-judgment skill plus offline scripts. There is no hosted API and no runtime that accepts untrusted input by default.

Use GitHub Security Advisories / private vulnerability reporting on this repository:

https://github.com/24601/Augustus/security/advisories/new

Do not open a public issue for a security report. There is no separate security email.

Please include what is affected (skill text, evaluator, workflows, Pages) and a way to reproduce. We will acknowledge and ship a fix on the supported line when the report is valid.

• Dependabot security updates
• Secret scanning
• Push protection for secrets

Do not commit API keys, tokens, or .env files. .gitignore covers the common names. Research folds quote public READMEs; they are not install recipes and must not paste live credentials.

evaluate_decisions.py --self-test is local scoring math. It does not call a model and does not need a key.