ambient-build-proof is designed to be safe to run on any repository.

• No account required. The CLI never asks you to sign in.
• No API keys required. Nothing about the core CLI depends on a key.
• No network calls in the core CLI. It reads files and runs your project's own scripts locally.
• Secret values are never read or printed. From .env.example / .env.sample templates it extracts variable names only, to report what the project requires — never the values. Real .env files are not parsed for values.
• Zero runtime dependencies. No third-party supply-chain surface at runtime. TypeScript and @types/node are devDependencies, used only to build.

The tool runs the project's own scripts (build, test, lint, typecheck) through the system shell, inheriting the current environment. Those scripts do whatever the project defines. Run the tool only in repositories you trust, the same way you would run npm test or npm run build yourself.

--quick performs detection only and runs none of these commands.

• docs/BUILD_PROOF.md includes the tail of command output for failures, so a failing test or build log may appear there. Review before sharing publicly.
• docs/BUILD_PROOF.json is gitignored by default.
• Never commit real secrets. .gitignore excludes .env and key files.

Until a formal channel is published, report security concerns privately to the repository owner (private repo). Do not open a public issue for sensitive reports.

Please include: what you found, how to reproduce it, and the potential impact.