Report suspected vulnerabilities privately through the repository security advisory flow. Do not include exploit details in a public issue.

This package validates view metadata and performs no runtime string code generation. It is not a sandbox: generic storage get and set methods, Proxies, and custom Math functions execute consumer code. Treat array storage and functions supplied by the host environment according to their trust level.