## Not vulnerabilities by design

<Accordion title="Common findings that are out of scope">

These patterns get reported often and are usually closed as no-action unless

a real boundary bypass is demonstrated:

These patterns get reported often and are usually closed as no-action unless

a real boundary bypass is demonstrated:

- Prompt-injection-only chains without a policy, auth, or sandbox bypass.

- Claims that assume hostile multi-tenant operation on one shared host or

approvals.

- "Missing per-user authorization" findings that treat `sessionKey` as an

auth token.

</Accordion>

</Accordion>

## Hardened baseline in 60 seconds