ROMS is an experimental local tool for a single trusted operator. The installed Omarchy gateway requires a private bearer key; this does not provide tenant isolation or authorize arbitrary tool execution. Keep the gateway bound to loopback and use trusted MCP clients. The default MCP profile permits read tools; operators can explicitly enable write and destructive tools. These process-wide controls are not client authentication or tenant isolation; see MCP settings.

• Python plugins in custom_tools/ are disabled by default. Explicitly allowed plugins execute with the server's filesystem permissions; hot reload requires a separate opt-in. Review every plugin before enabling it. The plugin folder is not a sandbox.
• Skills and retrieved text are untrusted input to an agent. Grounding prompts do not prevent prompt injection or guarantee correct actions.
• Experimental arbitrary container execution is disabled unless ROMS_ENABLE_EXPERIMENTAL_EXECUTION=1 is explicitly set. The installed workshop separately exposes registered Python validation through rootless Podman and the native Landlock boundary; verification covers that specific path. Workers require a preinstalled local image, never fall back to host execution and do not pull images during a task. Timeout, repeated cancellation, process death, queue capacity and cleanup retry have real tests. Network access is fixed off, capabilities are dropped, privilege escalation is disabled, and CPU/memory/process/output/time limits apply. These scoped results do not certify arbitrary programs, multi-tenant isolation or the full OS release. Arbitrary chat execution remains disabled.
• A failed worker cleanup retains its private task directory and container.json journal. The folder is removed only after owned containers are absent and the client process is reaped. scripts/cleanup_worker.py TASK_ID retries container removal; it preserves retained files for inspection. Worktree-removal failures are also retained and reported. Forced host termination/crash recovery still needs automatic reconciliation.
• Skill and knowledge names are restricted to simple filenames. This does not protect against a malicious local process racing filesystem changes.
• Memory project IDs filter records but do not authenticate clients. A trusted client can choose any project ID. Verification evidence is caller-supplied; the memory tools do not execute tests or authenticate results. Retrieved memory is untrusted content.
• Generated skills default to inactive drafts. Existing add_skill and explicit Python destination overrides remain privileged authoring paths requiring operator review.
• Forgetting a memory removes that record from application queries, not backups or recoverable SQLite pages.
• Automatic gateway chat trajectory capture is off unless the operator explicitly sets ROMS_RECORD_CHAT_TRAJECTORIES=1. Manual recording tools remain available. This setting does not erase existing data or control client/backend caches and logs; see privacy boundaries.
• Lessons, evidence references, trajectories, support tickets and generated research can contain private data. Keep data/, environment files, databases, generated datasets and credentials out of Git. Review knowledge, skills and custom tools individually before publishing.
• Remote embedding configurations send document/query text to that endpoint. The default local model may need a first-use download.
• Dependency vulnerability auditing, a clean-machine installation and Mojo compilation are separate release checks; passing regression tests does not substitute for them.

Report suspected security issues privately to the repository owner. Do not include secrets or private documents in public issues.