# Security

Scooling Lab is a training boundary, not the authority for private learner data.

## Rules

- Accept only server-side jobs from the main Scooling app or an approved local test harness.
- Never accept browser session tokens.
- Never write directly to Knowtation.
- Never store private vault data in this repository.
- Never commit checkpoints, adapters, model exports, private datasets, logs with learner content, or
  credentials.
- Keep worker logs content-free by default.
- Treat dependency and license scans as release gates.

## Reporting

Do not file public issues containing private learner data, credentials, model artifacts, or
deployment details. Use the private Scooling security channel until a public reporting address is
published.