Author here, first systems project. The README makes security claims, but there are some discrepancies and current limitations:

- The pipe handler runs as root for its whole life (no drop, no seccomp due to 0600 storage). Defense is safe Rust, no DWARF, and bounded I/O. - zstd is a C library on the hot path in a root process, fed attacker-controlled stdin. - hostname goes to kmsg unescaped via Display. - Some hardening directives are currently missing. - vdr-analyze, @@ handshake, and vacuum are not yet implemented.

Note: The README and current source may differ; please refer to the dev branch. Also, the UmaskGuard section in the dev branch is outdated.

Thanks for taking the time to read this far.