Security model and limits

What it protects

• Store values never pass through the CLI's own argv or diagnostics. show and list print names, masked lengths and paths only. run delivers selected keys through the child's environment and replaces every loaded value with <redacted> on stdout and stderr. If a redaction filter fails, run stops the child and exits 1 rather than printing unfiltered output.
• Writes are private and atomic. stash reads values from a hidden prompt or stdin, writes the replacement inside a private 0700 directory and renames it onto the store under a lock. It refuses symlinked and non-regular targets. File stores are parsed as KEY=VALUE data, never sourced as shell code.
• The guard denies the common accidents before a tool call runs: reading store files and well-known credential files (cloud CLI credentials, Docker and gh config, npmrc, pypirc, SSH private keys, /proc/*/environ), dumping the environment, credential printers such as gh auth token, gcloud auth print-access-token, op read, secret-tool and security -w, clipboard readers, and content searches over trees that hold protected files. The checks inspect syntax and path metadata; they never execute the command.
• Malformed requests deny. A nonempty malformed request or failed static analysis denies instead of allowing the tool call, and over-budget commands deny rather than being allowed. Split long commands into smaller calls.

The Bash guard requires jq and denies every request when jq is unavailable.

Names-only MCP boundaries

MCP is opt-in local stdio with explicit exact --store references, not a network service or credential transport. Its four tools never return values, value hashes or lengths and expose no mutation, resource or prompt capability.

Names-only metadata can still disclose key names, labels, presence, backend, references and paths, and provider account IDs to clients, models and logs. File metadata parsing may open local file bytes internally; provider metadata never calls value Get. Age outer metadata is unauthenticated. Health proves only configured readiness and store count. MCP registration grants no guard exception.

Installer trust

The pinned HTTPS one-liners execute a script before payload verification and trust GitHub HTTPS, repository ownership and tag governance and the reviewed installer. They resolve latest once (or use an explicit version), then verify HTTPS checksums, executable format and architecture and bounded new-binary version output. This detects corruption, not a compromised release publisher. There is no automatic attestation check; manual provenance and the stronger authenticated checkout route remain available. Installed executables are hashed, never executed, when deciding whether to replace them.

What it does not protect

These are outside the threat model. Reports about them are welcome as documentation or hardening suggestions, but they are not vulnerabilities.

• Transformed output. Redaction matches literal values. Base64, URL encoding, hex, substrings, reversed or split values are not caught.
• Shell indirection the guard cannot resolve statically. The guard tokenizes commands and never evaluates them. Variables set elsewhere, files of commands, eval, aliases, functions and interpreters reading paths from their input can name a protected file without spelling it.
• Deliberate shell and repository construction. Scripts or build files written and run in one command, and hand-built Git directories, are not tracked across command boundaries.
• Tools the guard does not see. The hook covers Claude Code's Bash, Read, Grep, Edit, Write, MultiEdit and NotebookEdit tools, and Codex's Bash shell hook and apply_patch. Hosted tools such as web search, MCP servers, other agents and other editors are not covered.
• Process-level visibility. A child that puts a value in its own argv exposes it to the local process list. Any process running as the same user can read the stores and, while a child runs, its environment.
• What env-file consumers do with values. docker run --env-file .env and similar consumers are allowed; an arbitrary program given those values can still print them.
• Executable substitution. The guard trusts command names. A different program named secret, cat or jq earlier on PATH is not detected.
• Clipboard consent. secret clip is allowed for agents because the value never reaches their output; the skill limits it to explicit user requests, which a hook cannot verify.
• Searches without the protective ripgrep config. Plain rg is treated as safe only when the effective ripgrep config excludes store files; otherwise content searches over trees holding protected files are denied.

Reporting

Use GitHub's private vulnerability reporting for anything that lets a value reach agent output through a path the guard or the CLI claims to cover. Describe the command or tool call and the observed decision. Never include a real credential; synthetic values like synthetic-token reproduce every case the test suites cover.