Generated Blender Python and submitted .blend files are untrusted. Candidate generation and extraction must run through the Docker isolation path. The --trusted-fixture option is for repository-owned author programs only.

The runtime uses read-only inputs, no network, bounded temporary output, process and memory limits, and controller-side output validation. These measures reduce exposure; a Blender or kernel vulnerability remains a reason to use a dedicated evaluation host without unrelated data or credentials. Runtime integration evidence and tested versions are documented in docs/CONTAINER_VALIDATION.md.

To report a vulnerability, use the repository's private vulnerability reporting feature when enabled. If it is unavailable, open an issue asking for a private reporting channel without including an exploit, credentials or private data. Do not submit a malicious file to public model runs as a way to report a bug.

Provide the affected version, minimal trigger, security boundary crossed and sanitized evidence. Benchmark gaming that does not cross a security boundary can be reported as an evaluator counterexample through the normal issue template.