# Security Each hosted submission contains a JSON plan and a checksum-verified archive of regular files tracked by Git. The archive excludes untracked files, symlinks, special files, and files outside the repository. The execution sandbox receives a credential that is valid only for one run attempt. It does not receive reusable GitHub, storage, workflow, or Radforge API credentials. Repository code and dependency hooks run in isolated infrastructure managed by Radforge. Radforge sets network and resource limits for the sandbox. Execution workspaces are temporary. Other records follow the retention rules in the Privacy Policy. Protect `RADFORGE_API_TOKEN` as a secret. GitHub App permissions are limited to checks write and contents, metadata, and pull requests read. Review repository selection and uninstall the app when access is no longer needed. Mutation results are not a security certification. Continue to use code review, dependency controls, static analysis, secret scanning, and security tests. Report a suspected vulnerability through the contact form at [radforge.dev](https://radforge.dev/#waitlist). Do not include exploit payloads, credentials, or customer source in an initial message; request a secure channel.