• malformed or oversized images;
• planner prompt/output injection and invalid tool names;
• unauthorized approval or action requests;
• altered or incomplete evidence exports;
• public object storage, over-broad AWS permissions, and leaked credentials;
• stored or reflected content rendered by the operator UI.

• The API enforces request limits and decodes images without executing metadata.
• Planner output is parsed into a closed tool vocabulary and checked against the current state before execution.
• Approval requires a non-empty human identity and only applies to the matching pending run; rejection cannot execute the action.
• Receipt chains use canonical JSON and SHA-256 link verification.
• UI content is assigned with text-safe DOM APIs rather than inserted as HTML.
• The S3 bucket is encrypted, versioned, private, and configured to block public access. The ECS task role is scoped to its bucket prefix and selected Bedrock model.
• Secrets are not stored in the repository or container image. AWS credential resolution uses the standard SDK provider chain and ECS task roles.

Do not include credentials, production images, or exploitable deployment details in a public issue. Contact the repository owner through the GitHub profile for a private reporting channel.