This is a local research prototype, not an authenticated multi-user service. The documented API and UI bind to loopback. Do not expose them publicly without separate authentication, authorization, request/workload limits and deployment review. The initial generation concurrency limit is one.

Generated code is returned as text and is never executed by the API handler. Optional Docker checks are explicit evaluation commands. They disable network, use read-only mounts/filesystems, a non-root user and resource/time limits. These controls reduce exposure; containers are not a guarantee of safe execution of arbitrary hostile code. Do not mount credentials, the Docker socket or personal directories into evaluation containers.

Retrieved code is quoted reference material, not trusted instructions. Citation validation checks IDs, not correctness, licensing or the absence of malicious behavior. Inspect source terms and generated code before reuse.

Never commit .env, credentials, private datasets or raw diagnostic dumps. The publication helper provides an allowlist and basic pattern checks, not a complete secret scan. If a credential is exposed, revoke/rotate it at its source; removing a file from the latest commit alone is insufficient.

No public security-response address or hosted vulnerability-reporting service has been configured. If a future repository enables GitHub private vulnerability reporting, use that channel for sensitive reports. Do not post live secrets in public issues.