ALPHA-MATH executes code generated by a configured local model. The sandbox uses an AST policy, a minimal builtin set, a fresh process, a hard timeout, output and source limits, and a Unix memory limit. These controls are designed for local or Kaggle execution of trusted model output.

Do not expose run_code as a public multi-tenant code-execution service. A public deployment requires a networkless container or microVM, an unprivileged user, read-only filesystem, cgroup CPU/memory/PID limits, syscall filtering, and independent security review.

Do not place API keys or Kaggle credentials in configs, reports, notebooks, or generated bundles. The bundle builder uses an explicit file allowlist and never includes .env, model weights, .git, or result archives.