The latest released version is supported.

RefEngine must not:

• upload PDFs, RIS, or BibTeX files;
• expose a file-upload endpoint;
• bind the official server to a public interface;
• call remote metadata APIs;
• send telemetry or OCR output;
• execute remote model inference.

The official CLI binds to 127.0.0.1. CORS is limited to local React development origins. Source files are read from the project input/ directory.

• Source files are opened read-only.
• Each execution processes an immutable local snapshot.
• Draft data is stored under data/runs/.
• Final files are generated only after explicit publication.
• output/latest is replaced atomically and previous successful output is retained in history.
• File hashes support inventory, deduplication, cache, and audit records.

Use a private GitHub security advisory. Do not attach confidential academic documents to a public issue.