Agent Valley runs simulations locally or in your own infrastructure. It does not expose network services or handle user data.

If you discover a security vulnerability in the simulation engine, model output, or LLM prompt injection vector, please:

1. Do not open a public issue.
2. Email security@emergence.science with details.
3. Allow up to 7 days for acknowledgment and 30 days for a fix.

Agent Valley sends strategic queries to LLM APIs. Ensure:

• API keys are stored in environment variables, never committed
• LLM outputs are validated by the guardrail system before affecting simulation state
• No real user data or credentials appear in LLM prompts