fix: add security caution language to AutoGen Studio READMEs and docs

Add the caution and security note language to the AutoGen Studio
GitHub README, the main repo README, and the installation docs
to make it clear that AutoGen Studio is not production-ready.

Also fix minor lint issues from prior commit (ruff format,
unused import).

Author: victordibia

README.md

@@ -152,6 +152,12 @@ For more advanced multi-agent orchestrations and workflows, read
 
 Use AutoGen Studio to prototype and run multi-agent workflows without writing code.
 
+> **Caution**: AutoGen Studio is meant to help you rapidly prototype multi-agent workflows and
+> demonstrate an example of end user interfaces built with AutoGen. It is **not meant to be a
+> production-ready app**. Developers are encouraged to use the AutoGen framework to build their own
+> applications, implementing authentication, security and other features required for deployed
+> applications. See the [security note](https://microsoft.github.io/autogen/dev/user-guide/autogenstudio-user-guide/index.html#a-note-on-security) for more details.
+
 ```bash
 # Run AutoGen Studio on http://localhost:8080
 autogenstudio ui --port 8080 --appdir ./my-app

python/docs/src/user-guide/autogenstudio-user-guide/installation.md

@@ -7,6 +7,10 @@ myst:
 
 # Installation
 
+```{caution}
+AutoGen Studio is meant to help you rapidly prototype multi-agent workflows and demonstrate an example of end user interfaces built with AutoGen. It is not meant to be a production-ready app. Developers are encouraged to use the AutoGen framework to build their own applications, implementing authentication, security and other features required for deployed applications.
+```
+
 There are two ways to install AutoGen Studio - from PyPi or from source. We **recommend installing from PyPi** unless you plan to modify the source code.
 
 ## Create a Virtual Environment (Recommended)

python/packages/autogen-core/src/autogen_core/_component_config.py

@@ -74,9 +74,7 @@ def _get_trusted_namespaces() -> tuple[str, ...]:
     extra = os.environ.get("AUTOGEN_ALLOWED_PROVIDER_NAMESPACES", "")
     if extra:
         extras = tuple(
-            ns.strip() if ns.strip().endswith(".") else ns.strip() + "."
-            for ns in extra.split(",")
-            if ns.strip()
+            ns.strip() if ns.strip().endswith(".") else ns.strip() + "." for ns in extra.split(",") if ns.strip()
         )
         return _TRUSTED_PROVIDER_NAMESPACES + extras
     return _TRUSTED_PROVIDER_NAMESPACES

python/packages/autogen-core/tests/test_component_config.py

@@ -371,8 +371,6 @@ def test_component_descriptions() -> None:
 
 def test_untrusted_provider_rejected() -> None:
     """load_component must reject providers outside trusted namespaces."""
-    import os
-
     bad_model = ComponentModel(provider="os.path.join", config={})
     with pytest.raises(ValueError, match="not in a trusted namespace"):
         ComponentLoader.load_component(bad_model, object)  # type: ignore

python/packages/autogen-studio/README.md

@@ -9,8 +9,19 @@ AutoGen Studio is an AutoGen-powered AI app (user interface) to help you rapidly
 
 Code for AutoGen Studio is on GitHub at [microsoft/autogen](https://github.com/microsoft/autogen/tree/main/python/packages/autogen-studio)
 
+> [!CAUTION]
+> AutoGen Studio is meant to help you rapidly prototype multi-agent workflows and demonstrate an example of end user interfaces built with AutoGen. It is **not meant to be a production-ready app**. Developers are encouraged to use the [AutoGen framework](https://microsoft.github.io/autogen) to build their own applications, implementing authentication, security and other features required for deployed applications.
+
 > [!WARNING]
-> AutoGen Studio is under active development and is currently not meant to be a production-ready app. Expect breaking changes in upcoming releases. [Documentation](https://microsoft.github.io/autogen/docs/autogen-studio/getting-started) and the `README.md` might be outdated.
+> AutoGen Studio is under active development. Expect breaking changes in upcoming releases.
+
+## A Note on Security
+
+AutoGen Studio is a research prototype and is **not meant to be used** in a production environment. Some baseline practices are encouraged e.g., using Docker code execution environment for your agents.
+
+However, other considerations such as rigorous tests related to jailbreaking, ensuring LLMs only have access to the right keys of data given the end user's permissions, and other security features are not implemented in AutoGen Studio.
+
+If you are building a production application, please use the [AutoGen framework](https://microsoft.github.io/autogen) and implement the necessary security features.
 
 ## Updates