Security and data visibility

• .woml source contains symbolic secret names, never values.
• Run inspection excludes payloads, context, results, secret values, credentials, operation/idempotency keys, provider bodies, and stack traces.
• Managed operation events contain bounded safe metadata, not request/response bodies, SQL, database parameters, object bodies, or state/cache values.
• A script can deliberately return or transmit sensitive data; WOML cannot infer business sensitivity, so authors remain responsible for what their code returns and sends.
• The state SQLite file is hardened to owner-only mode on Unix but is not transparently encrypted. Protect disks, directories, snapshots, and backups.
• Native Fetch and managed HTTP in the local profile are not an SSRF sandbox.
• Bun worker isolation is not a hostile multi-tenant security boundary.
• Public webhooks, event publication, WhatsApp callbacks, and reverse proxies require deliberate authentication/TLS deployment.
• Local administration is state/runtime scoped and loopback-only in v1; do not expose the state file or wrap commands in an unauthenticated remote API.