Tor
Roadmap
No Tor client in the default ISO
The kill switch would already protect the tunnel if you install one
dVPN / WireGuard
Roadmap
No WireGuard/Sentinel client out of the box
Real nftables kill switch, opt-in, fail-closed
DNS
Not wired up
DoH/DoT/DNSSEC: declared in config
No script configures the resolver today
Leak protection — real today vs. roadmap
Fail-closed nftables kill switch (protects a tunnel if you configure one)
○ Public IP masked via Tor — roadmap, no client installed
○ Per-connection MAC randomization — declared in config, not wired up
○ DNS leak protection — roadmap, resolver not wired up
○ WebRTC blocked — depends on the browser, not on the OS