Security and Operational Safety

• Fail-closed by default
• Minimal data collection
• No inbound access requirements
• Operator intent preserved
• Audit-grade evidence

PatchPilot is designed to pass security review before it is ever trusted in production.