ForthUkr is a local educational interpreter. Forth programs can read and write files, but only inside the current working directory (the IDE uses an application workspace, not the source tree).

• Path traversal that writes or deletes files outside the working directory
• Crash / hang bugs that make the IDE unusable (iteration, memory, recursion, and include limits are user-configurable; 0 disables a limit)
• Untrusted input that escapes the interpreter into host process memory

• Running Forth as a networked service
• Sandboxing CPU or RAM beyond the built-in cell and iteration caps
• Social-engineering through example programs

Please open a GitHub issue titled security: … or email the maintainer listed in the git history. Do not attach exploit samples that delete arbitrary user files; a minimal path is enough.

File words (записати_файл / write-file, видалити_файл / delete-file, mkdir, include) are powerful by design. Treat .fukr files like scripts: only run code you trust.