Only the latest public Penrose release receives security fixes.

Please use GitHub's private security-advisory flow for the PattersonResearch/Penrose repository. Do not open a public issue for a vulnerability that could expose credentials, private research inputs, confirmation data, filesystem contents, or a sandbox escape.

Include the affected version, operating system, reproduction steps, expected security boundary, and observed behavior. Redact API keys, tokens, private datasets, strategy code, local paths, and proprietary research.

Penrose is a local research referee, not a hosted trading service. The core runs keyless; model-assisted paths use operator-provided credentials and must fail safely when they are absent. The dashboard binds to localhost by default, denies untrusted origins, and requires its local token for mutations. Generated or community code is not trusted merely because Penrose produced or received it, and no automated surface may cross the human P9 approval gate.

One isolation limitation is disclosed explicitly. When Penrose reproduces a shared, signed bundle, the frozen strategy module executes in the same interpreter as the P7/P8 adjudicator — it is not process-isolated. A self-signed bundle therefore earns only an integrity-only verification label and does not establish independent trustworthiness; isolating that phase from a fresh P7/P8 process is a tracked hardening follow-up. See docs/OPEN_SCIENCE.md. (Model-generated reconstruction code is a separate path and always runs inside the Docker sandbox.)

The public corpus and Builder Pennie are not enabled data-upload or code-modification services in the current release. Do not rely on planned or stubbed functionality as a security control.