Lua Linear assumes that callers, input data, the Lua runtime, and the linked BLAS and LAPACK libraries are trusted. It is not designed to isolate mutually untrusted parties or safely process attacker-controlled data. Applications are responsible for access control, process isolation, dependency compatibility, and resource limits. Reports that require a violation of these assumptions are outside the project's security scope, but may still be considered as ordinary robustness or correctness issues.