Threat model
- Cloud: phishing, vendor breach, compliance gaps → full leak
- Local: lost laptop, unencrypted disk, unencrypted backup → your scope
What you should still do locally
- Full-disk encryption (FileVault / BitLocker)
- Git-push the vault to an encrypted remote
- Include
.kition/in backups - Rotate API keys periodically
