Is lil-terminal safe to leave on a production site?
It can be operated responsibly, but it is an administrative tool and must be protected like one.
Recommended setup
Use an authorized build, a unique strong password, HTTPS, protected PHP web integration if embedding, and the smallest useful module set. Keep lil.php and .lil.key outside public listings.
Operational discipline
Review installed modules, update through Upgrade, remove the terminal with kill when no longer needed and never share activation tokens or terminal URLs in public logs.
What it does not do
The project cannot compensate for a compromised hosting account, insecure application code or excessive filesystem permissions. It works inside the security boundary of the current PHP process.