Report suspected vulnerabilities using GitHub private vulnerability reporting. Include the affected source version, Lua integer build, a minimal synthetic reproducer and the expected versus observed contract behavior. Do not include secrets, real personal data or private client code.

General contact is available through the Lofrano Tecnologia homepage. No response-time or remediation SLA is promised.

The current documented line is development version 0.1.0. There is no separate maintenance or production-support promise. Relevant concerns include unexpected unbounded retention, integer wraparound, mutation on validated failure, bypass of ID/capacity checks, result aliasing or unintended caller-code execution.

The module does not read network input, execute jobs, load external scripts, persist state or contain credentials. Its CLI accepts only fixed demonstration flags and does not parse external transcripts. Applications remain responsible for authenticating callers, assigning honest costs, mapping IDs to their own work, serializing instance access and enforcing any surrounding resource policies.

Configured bounds cap scheduler records and logical costs, not exact allocator bytes or wall-clock duration. Lua memory exhaustion, process interruption, hostile replacement of module definitions and unsupported concurrent use are outside the transactional contract. If a failure appears to cross these boundaries unexpectedly, report it privately with a synthetic example.