Distil
Security
Everything security-relevant lives in one of three source-of-truth documents in the repository — this page just points to them, so nothing here can drift out of sync with what's actually shipped.
SECURITY.md
Do not open a public issue for a suspected vulnerability. Report privately through GitHub's private vulnerability reporting on the repository — what to include, what to expect, and the supported-versions policy.
SECURITY-WHITEPAPER.md
Data flow and residency, encryption at rest, what leaves the machine (nothing, by default), and every claim written to name the file, command, or test that backs it.
Deploy & Security
The three supported deployment topologies — local sidecar, container sidecar, shared gateway — and the security model each one gets by default.
Threat model & telemetry
THREAT_MODEL.md — the adversary model and explicit non-goals. TELEMETRY.md — the frozen, test-enforced schema for the one thing distil can ever send (opt-in, off by default).