PRAXO-CORE is a framework, not a product. Signature trust, tenant policy, credential storage, and plugin materialization belong to the embedding product (PRAXOVELA) or the external integrator.

Do not open a public issue for a vulnerability. Use the repository's private security advisory feature:

https://github.com/axisvela/praxo-core/security/advisories/new

Include the affected package, version, a minimal reproducer, and the impact. Reports are handled on a best-effort basis; no response or backport SLA is promised.

In scope:

• pkg/plugin and pkg/plugin/host/{process,wasm}
• pkg/policy path containment
• pkg/toolcall, pkg/plugin/manifest, and pkg/tool/jsonschema parsers
• pkg/agent policy/tool enforcement
• pkg/httpclient transport behavior

Out of scope for this repository:

• PRAXOVELA product wiring, signature trust stores, tenant policy, and materialization
• third-party provider or sandbox implementations
• prompt-injection content that is correctly denied by policy

See security model for the framework threat model and known limitations, plugin trust and SBOM for the product-owned plugin verification and SBOM handoff, and docs/containment-review.md for the internal control map and residual risks. The containment review is not independent sign-off.