Can someone direct me to any official KeyOS statements about the purpose and extent of security measures the OS is supposed to provide/achieve?

Just doing a quick security audit and I see several things which need to be addressed before I would even think about using KeyOS outside of testing purposes.

TIA