# Security

Please report security issues privately to Wildmason before public disclosure.

`gha-runner-image-proof` does not call any network service. It reads a runner-image manifest, optionally inspects the local host with read-only probes (`<tool> --version`, OS package queries), and shells out to the Docker CLI for `probe-docker`. Docker probes use `docker image inspect` and `docker run --rm`; the crate never mounts the Docker socket into a probe container by default and never starts background containers. Stdout/stderr excerpts are captured in receipts — callers are responsible for ensuring probes do not echo secrets.
