This repository is a contained, synthetic research instrument. Do not place credentials, personal data, production documents, or real targets in the lab.

The default tools operate only on fixed in-memory fixtures and example.invalid destinations. The optional model adapter accepts only literal loopback HTTP addresses and does not read credentials. These boundaries are part of the test surface; changes that weaken them should be treated as security-sensitive.

If you identify a vulnerability, avoid including secrets or real private data in a public issue. Provide a minimal synthetic reproduction.