[cf3901646]

Summary of Changes

1. Evaluator security documentation: Added clear warnings in openevolve/evaluator.py about the security implications of running evaluation code in-process with caller's environment
2. Visualizer authentication: Added token-based authentication to /api/data and /program/<program_id> endpoints in scripts/visualizer.py
3. Visualizer debug mode: Moved debug=True behind a local-only flag to prevent exposing debugger in production
4. Visualizer trailing slash fix: Fixed find_latest_checkpoint to handle trailing slashes correctly
5. Visualizer bind address: Changed default bind to 127.0.0.1 with warning for 0.0.0.0

Motivation & Context

Closes security concerns around:

• Evaluator code execution inheriting caller's environment (Issue evaluator exec_module operator-supplied code in-process; visualizer` serves checkpoint data with no auth #481)
• Visualizer serving sensitive data without authentication (Issue evaluator exec_module operator-supplied code in-process; visualizer` serves checkpoint data with no auth #481)

Verification

1. Evaluator documentation warnings are visible in code
2. Visualizer requires authentication token for API endpoints
3. Debug mode only enabled when explicitly requested
4. Checkpoint detection works with or without trailing slash
5. Default bind is localhost-only

• Gate Report: Python syntax compiled: openevolve/evaluator.py; Notice: Python tests had failures in tests/

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}