AgentForge interacts with browser/sandbox environments and external model APIs. Treat credentials and experiment artifacts as sensitive.

• Keep API keys only in local .env files.
• Never commit .env, API keys, access tokens, or session credentials.
• Use .env.example as the shareable configuration template.
• Rotate a credential immediately if it is accidentally exposed.

AgentForge is designed to validate actions before execution and to distinguish blocked risky actions from successfully executed destructive actions. Run experiments only against disposable benchmark environments unless you have explicitly reviewed the target.

Experiment trajectories and audit trails may contain browser URLs, page content, screenshots, and other execution evidence. Review artifacts before publishing them externally.