Merge pull request #2560 from deepseek-harness/codex/add-security-policy

docs: add bilingual experimental safety notice

SAFETY.md

@@ -0,0 +1,27 @@
+# Safety
+
+English | [中文](SAFETY.zh.md)
+
+## Experimental status
+
+DeepSeek Harness is experimental developer-preview software. It has not undergone a security audit and must not be treated as secure or production-ready.
+
+The project can execute model-generated code and commands, load third-party plugins, and access the network, processes, credentials, and files made available to it. Incorrect model output, defects, misconfiguration, malicious input, or untrusted plugins may damage the host computer, modify or delete files, disclose data or credentials, or cause other unintended effects.
+
+## Sandbox limitations
+
+Sandboxing, approval prompts, and permission controls can reduce risk, but they do not guarantee isolation or prevent damage. Even correctly enforced restrictions cannot protect resources that the project is allowed to access.
+
+Do not rely on DeepSeek Harness as the sole security control for untrusted workloads.
+
+## Responsible use
+
+- Run the project with the least privileges and access required.
+- Prefer a disposable virtual machine, container, or dedicated environment.
+- Keep backups of files that the project can access.
+- Do not expose sensitive credentials or data unless you accept the risk.
+- Review plugins, configuration, and proposed commands before allowing them to run.
+
+## No warranty or liability
+
+Use DeepSeek Harness at your own risk. The software is provided without warranty under the [MIT License](LICENSE). To the maximum extent permitted by applicable law, the authors and copyright holders are not responsible for damage to computers, loss or disclosure of data, loss of files, or other harm arising from use of the project.