Please report vulnerabilities privately through GitHub Security Advisories after replacing the placeholder repository URL in pyproject.toml.

TaskDistill can send prompts and seed data to external model providers. Do not place secrets, personal data, confidential documents, or regulated records in a project unless the selected provider and your data-processing agreement permit it.

The command teacher and student backends execute shell commands from configuration. Treat a downloaded taskdistill.toml as executable code. Review it before running.

Generated examples are untrusted model output. TaskDistill parses them as data and does not execute them, but downstream training or export scripts may introduce their own risks.

API keys are read from environment variables. They are never intentionally written to run artifacts. Review logs before publishing them.