Live execution is disabled in code (ALLOW_LIVE=false). There is no production deployment to patch in this tree.

Do not open a public issue for sensitive reports. Use GitHub private vulnerability reporting (repository Security tab, Report a vulnerability).

• Include: affected file/commit, reproduction steps, impact, and whether credentials or private data are involved.

Plugins run with your user privileges. Install only plugins you trust:

• explicit pip install or --dir only (discovery never downloads),
• read manifest.json (licence, rights, network, secrets) before use,
• tellurion plugins validate ./plugin_dir must not report FAIL,
• UNKNOWN data rights = never production-qualified.

Software licence and data rights are separate. Contributors must only submit data they may redistribute; reviewers check rights basis per docs/guides/rights-policy.md.

Lawful public and licensed data only. Do not use this project to scrape sources, circumvent access controls or paywalls, or violate terms of service. Report rights violations as data-rights issues.

Community paths make no outbound network calls (localhost only). tellurion doctor verifies this on every run.