正文
获取原文件references/security-policy.md
Bundled production scripts make no network calls, install no packages, and execute no acquired code. Queries have a heuristic identifier/secret scan; the scan is not complete PHI detection or host-level isolation. Hash/size checks and package locks detect ordinary mutation, not a malicious actor able to rewrite both receipts and code. Use a single writer and an isolated workspace with OS CPU/memory/disk quotas. No race-resistance guarantee is made. Archive inventories reject known path/link/device/encryption/size/ratio/collision risks; no recursive extraction or selected executable files. Source names, license decisions and medical validation labels still require real source/operator review.