SplitProof does not execute dataset content, but it parses untrusted JSON and writes output files. Do not use it as a sandbox boundary.

For a suspected vulnerability, do not open a public issue. Use GitHub's private vulnerability reporting. Include the affected version, reproduction steps, impact, and any suggested mitigation. Maintainers will acknowledge a complete report within seven days and coordinate disclosure after a fix is available.

Only the latest released minor version receives security fixes during the alpha phase.