If you discover a security vulnerability in Anvil, please do not open a public issue. Instead, report it privately:

• Email: akmal.melibaev@gmail.com
• Subject line: [SECURITY] Anvil — brief description

I take security seriously and will respond within 72 hours. Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

Anvil executes code on behalf of LLMs, which makes security a first-class concern. The project includes several layers of protection:

Command blocking — dangerous commands (sudo, ssh, mkfs, etc.) are blocked before execution.

Pattern matching — risky patterns like rm -rf /, piping to shell (curl | sh), and overly permissive chmod are detected and rejected.

Path validation — all file operations are restricted to the project directory. Path traversal attempts are blocked.

Security levels — three modes (STRICT, STANDARD, PERMISSIVE) control network access and command scope.

Docker sandboxing — optional container-based isolation for untrusted code execution.

This policy covers the Anvil runtime itself. It does not cover code generated by LLMs during execution — always review generated code before running it in production.