Ambient Handoff is designed to be safe by default: it runs locally, reads your repo, and writes markdown. It is intentionally small in surface area.
- No network. The CLI makes no outbound network calls.
- No auth, no API keys. Nothing to leak; nothing to phish.
- No runtime dependencies. No third-party code runs at runtime — only Node
built-ins and
git. - Read-mostly. The CLI reads git/package metadata and writes only to
docs/and the gitignored.ambient/state.json. It never modifies your source.
| Action | Scope |
|---|---|
| Reads | git status/log/branch/remote, package.json scripts, build output (only when you pass --after-build). |
| Writes | Six files in docs/, plus .ambient/state.json (gitignored). |
When you pass --after-build [cmd], the CLI executes that command (default
npm run build) in a shell to capture its result. Only run build commands you
trust — this is the same trust boundary as running the command yourself.
- The CLI does not read
.envfiles or environment secrets. .gitignoreexcludes.env*,*.pem,*.key,secrets.json, and.ambient/state.json.- Captured build output is truncated to the last ~40 lines. If your build prints
secrets to stdout, review
docs/BUILD_LOG.mdbefore committing it.
This is an early-stage project. Please report security issues privately via a GitHub security advisory or by opening a minimal issue that does not disclose exploit details. We will respond as quickly as we can.
During 0.x, only the latest release receives fixes.