This repository distributes a declarative JSON manifest. It must not contain executable runtime code, credentials, telemetry, or remote network instructions.

Report a suspected security issue privately through the security contact on the Deft project rather than opening a public issue with exploit details. Include the affected manifest version and digest, the Deft version, and a minimal reproduction that contains no real workspace data.

Fixture records and screenshots must remain fictional. The repository's sample domains use .test; they are not live destinations.