This is a developer preview. Report reproducible security problems privately to a repository maintainer through GitHub's private vulnerability reporting when available; otherwise contact a maintainer before disclosing details. No guaranteed response time or formal security audit is claimed.

Use synthetic fixtures. Evidence files and reports can contain customer information; store/share them under your own access controls. Validation does not fetch evidence URLs, verify physical events or establish manufacturer authorization. Reviewed Rule Packs are configuration, not a sandbox for arbitrary hostile schemas. Keep input sizes bounded and do not expose the library directly as an untrusted public service.

The CLI reads explicit local files. Catalog traversal is restricted to its directory. Reports are off-chain and may contain record identifiers.

No warranty eligibility, legal compliance, production security or financial guarantee follows from a green test suite.