Please report vulnerabilities through GitHub's private vulnerability reporting feature rather than a public issue.

LLM Exerciser sends configured prompts to configured endpoints and records an output preview in its JSONL results. Treat configuration files as trusted input, scope API credentials narrowly, and avoid placing secrets in prompts or test expectations.

The optional GuideLLM executable and all configured endpoint or Prometheus URLs must also be trusted by the operator. The exerciser does not sandbox external load generators or remote response data.