# Security and responsible use

MoonRestrict is an offline synthetic-sequence computation library, not a clinical product, laboratory controller, or experiment-success predictor. It has no network, process, credential or file access in its reusable core. Command adapters only read argv and write results; fixtures contain no real organism data.

Treat DNA, models and serialized reports as untrusted. Use constructors and resource ceilings; verify decoded reports against the original request before consuming them. Cut/fragment arrays are public mutable values, so prior verification does not survive mutation. Verification is semantic replay, not a digital signature, checksum, authorship proof or provenance guarantee. Upstream duplicate-key JSON behavior is not suitable as an authentication encoding.

Do not pass secrets, clinical identifiers or private sequences on command lines: OS process listings/history can expose argv. Use the in-process library for such data and apply your own transport/storage access controls. Never attach private inputs to public issues. Diagnostic codes omit sequence content, but successful reports contain source-derived bases by design.

Resource ceilings reduce accidental resource use; they are not an isolation boundary or a guarantee against all denial-of-service inputs. Servers embedding the library need byte/request/time limits and isolation. No remote execution, archive extraction or automatic publication is performed by the library.

Report ordinary correctness defects via a repository issue with a minimal synthetic reproduction. For sensitive reports, use GitHub private vulnerability reporting if enabled, or request a private maintainer channel without disclosing the exploit or sensitive data publicly. Do not assume private reporting has already been enabled. See THIRD_PARTY.md for upstream provenance.