Lua H3 assumes that callers, input data, the Lua runtime, and the linked H3 library are trusted. It is not designed to isolate mutually untrusted parties or safely process attacker-controlled data. Applications are responsible for access control, process isolation, dependency compatibility, and resource limits. Reports that require a violation of these assumptions are outside the project's security scope, but may still be considered as ordinary robustness or correctness issues.