Security fixes target the latest 2.1.x release. GhostTrial is a public beta and a local educational sandbox, not an endpoint protection product or malware detector.

Report reproducible vulnerabilities through GitHub's private vulnerability reporting feature if enabled on the hosting repository. If it is unavailable, open an issue requesting a private contact channel without disclosing exploit details or private data. No unverified security email address is supplied.

• The Windows adapter opens handles with PROCESS_VM_READ | PROCESS_QUERY_INFORMATION (0x0410) only. It binds read/query/close functions, with no target mutation APIs.
• No privilege adjustment, protected-process workaround, injection, persistence, evasion, network service, credential extraction or automatic memory attachment.
• A process must be selected. Its creation time is checked before and against the opened handle to defend against PID reuse. Handles close on success and failure.
• Reads are bounded by bytes attempted, matches and elapsed time. Guard and inaccessible pages are skipped. Cancellation is cooperative between native calls.
• Reports contain query values, paths and addresses, but no raw memory buffers. Logs, settings and session files are ordinary local files using OS permissions; they are not encrypted. Review reports before sharing them.
• Lab cleanup accepts known fake artifacts and their expected hashes only. Changed files and unrelated files remain. Path traversal and linked paths are rejected.

Read-only access can still consume resources and observe sensitive information. Only inspect authorized test processes. A permission failure is a supported result. Game compatibility or permission under a game's rules is not guaranteed.

The boundary prevents accidental invasive features in this application. Python code can be modified by its owner; static tests are regression checks, not a security proof. Do not use a shared/untrusted data directory. Local filesystem attackers with concurrent write access can race integrity checks; cleanup is not designed to resist an adversary controlling the same directory. Use a private lab folder. Integrity checks detect content changes and missing artifacts, not reads or the actor involved. Sessions are bounded per file; old session files and lab runs require manual review and removal. No global disk quota is enforced.