Security

Security and trust boundaries

Kiln currently runs trusted applications under the supervisor's OS user. Administrator access can install executables and should be treated as host-level privilege. Role policy, encrypted storage and Linux cgroup limits do not isolate hostile tenants.

SSH uses public-key authentication and persistent host identity. Peer adoption pins node identity. Treat unexpected host-key changes as a trust event rather than deleting known-host records automatically.

Report vulnerabilities through GitHub private reporting, not public issues. Include the affected revision, a minimal reproduction and the expected trust boundary. Do not include live keys, production state or customer data.

The security policy is the maintained reporting reference. There is no security certification or guaranteed response-time claim.