Mill is pre-alpha and has no supported release yet. Do not use it on hostile repositories, production systems, or sensitive source until the relevant trust mode and support combination are explicitly qualified.

Report vulnerabilities through GitHub private vulnerability reporting. Do not open a public issue for an undisclosed vulnerability. David Ahmann coordinates triage and disclosure on a best-effort basis with no SLA.

Mill does not store provider credentials. Telemetry is off by default. Model and research calls must disclose the provider and selected data classes before use. Detailed retention, purge, and support-bundle behavior is a Wave 2 gate.