Please do not open a public issue for a suspected security vulnerability. Use the repository's private security reporting channel when this project is hosted on GitHub, or contact the maintainers directly with a minimal reproduction and the affected version.

Include whether the issue involves credentials, prompt or response data, capture storage, redaction, or upstream request routing. Do not include real secrets or sensitive customer data in a report.

• Treat the proxy as a trusted boundary. It can handle API credentials, prompts, tool arguments, responses, and metadata.
• The default Docker Compose configuration is local-only. Bind it to a controlled address and put authentication, rate limiting, and network policy in front of it before exposing it to other users or networks.
• The forwarding route is intentionally a catch-all. Restrict upstream hosts and paths at the deployment boundary if clients must not reach provider file, management, or other provider-specific operations.
• Keep raw capture disabled unless it is required. If enabled, use encrypted storage, restrictive filesystem permissions, and an explicit retention/deletion process.
• Use HTTPS for HTTP capture receivers. The DISTILLER_CAPTURE_ALLOW_INSECURE_HTTP setting exists only for controlled local development.
• Redaction is optional and off by default. The first supported adapter is Tonic Textual; unsupported provider shapes fail closed by default, but fields outside a dialect's supported text shapes are not a universal privacy guarantee.
• Keep upstream credentials and capture credentials outside source control and rotate them if exposure is suspected.