glueRun-go runs repo-configured shell commands and launches local coding agents in git worktrees. Treat a repo's gluerun.config.json, gluerun.config.sh, task files, and opt-in modules as executable trust boundaries.

Use GitHub's private vulnerability reporting for this repository. If private reporting is unavailable, open a minimal public issue asking for a private channel and do not include exploit details, credentials, or proof-of-concept payloads in the public issue.

Do not commit credentials, .env files, .gluerun-state/, .worktrees/, .gluerun-evidence/, or generated run artifacts. Runtime operator overrides and secrets belong in .gluerun-state/config.local.sh, which is gitignored by the scaffold.