Palisade executes only the commands you admit through policy - review policies before running them. No network calls. If you find a vulnerability (policy injection, glob-based path escapes, env smuggling), open a private security advisory rather than a public issue. Expect a first response within 7 days.