Report vulnerabilities privately through GitHub Security Advisories. Do not place credentials, tokens, production metadata, or production data in public issues.

Future Tense treats diffs, DataHub documents, SQL, model output, GitHub responses, run IDs, and execution logs as untrusted input.

• Run IDs accept only 1-80 character UUID/safe-slug forms. Separators, traversal, drive letters, absolute paths, encoded traversal, controls, and excessive identifiers are rejected. Resolved artifact paths must remain under the configured root.
• SQL execution is confined to an allowlisted protocol and an isolated Morrow PostgreSQL target. PR shell commands are never executed.
• Repair Agent output is schema-validated, path-scoped, destructive-token checked, hashed, git apply --check validated, and executed only by the deterministic layer.
• Reset and writeback require FUTURE_TENSE_DEMO_MODE=1, explicit confirmation, and a matching mutation token. GitHub publication separately requires explicit confirmation. No auto-merge exists.
• DataHub reset is restricted to allowlisted local demo GMS URLs and exact demo-owned entities.
• Docker ports bind to 127.0.0.1; application containers run as non-root with all capabilities dropped and no-new-privileges.
• Logs and artifacts have configured size limits. Potential SQL output is excerpted; never seed production or sensitive data into the demo.

The committed Morrow password is disposable localhost-only demo material. It is not safe outside the isolated local compose environment.