KernelProof executes GPU programs. Built-in candidates are reviewable repository code, but the architecture is intended eventually to evaluate model-generated candidates.

The current Python process boundary is not a security sandbox. Do not execute an untrusted candidate on a workstation containing sensitive data or irreplaceable GPU state.

Production hardening should include:

• an ephemeral VM or container with no host credentials;
• a dedicated or resettable accelerator;
• compilation and execution timeouts enforced outside the worker;
• CPU, memory, disk, and process limits;
• network disabled by default;
• read-only task inputs and a write-only artifact directory;
• driver-health checks and worker disposal after fatal CUDA errors;
• signed task and reference definitions.

Report vulnerabilities privately through GitHub's security-advisory interface rather than a public issue.