RefineGate is a closed, non-deployed research archive. Security fixes affecting its preserved reproduction surface are maintained on the default branch. Please report a suspected vulnerability through a private GitHub security advisory rather than a public issue.

• The active RefineGate core has one declared data-format dependency, PyYAML, and delegates host search, probes, and oracle fitting through explicit data/provider boundaries.
• Track declared project dependencies, not ambient pip freeze snapshots.
• Keep generated environments and run-local dependency exports out of Git.
• Run the dependency-audit workflow on every dependency change and weekly.
• Never deserialize executable objects from trajectory or oracle artifacts; active interchange uses strict JSON/JSONL.

The ArrayPull/CurvSift tree is an archived, non-deployed research artifact. Its historical CUDA/PyTorch environment is not part of the supported RefineGate runtime and must not be exposed as a service. Reproduction should occur in an isolated environment using its declared archive protocol.

The separately maintained RefineReplay package has its own security policy.