Journeyman has zero runtime dependencies and never executes agent output or touches your filesystem — every scene world is simulated in-process. The main surfaces are the HTTP calls it makes to the endpoints you point it at.
If you find a vulnerability, please do not open a public issue. Report it privately via GitHub's "Report a vulnerability" (Security Advisories) on this repository, or contact the maintainers directly. We'll acknowledge and work a fix as fast as we reasonably can.
Supported: the latest released version on PyPI.