OpsTerm's security model, best practices, and known considerations.

OpsTerm runs on your local machine. The AI never runs on remote servers:

• AI API keys stay on your laptop
• SSH keys are used from your local agent
• No server-side installation needed (except SSH)

Unlike other tools, OpsTerm doesn't install anything on remote servers. This means:

• No persistence on remote machines
• No privileged daemons running on your VPS
• Clean SSH sessions — nothing left behind

Your AI provider API key is stored in ~/.opsterm/config.yaml:

# Recommended: restrictive permissions
chmod 600 ~/.opsterm/config.yaml

export OPSTERM_API_KEY=sk-xxx
# config.yaml can omit api_key when env var is set

This is useful for CI/CD or shared environments.

• OpsTerm uses your existing SSH keys and ~/.ssh/config
• No SSH password storage in plaintext
• ProxyJump support for bastion hosts
• SSH connection timeout configurable via OPSTERM_SSH_TIMEOUT

1. Restrict config file permissions:

   chmod 600 ~/.opsterm/config.yaml
   chmod 700 ~/.opsterm/

2. Use environment variables for CI:

   export OPSTERM_API_KEY=$CI_AI_KEY

3. Audit server list:

   opsterm servers  # review configured servers

• AI queries containing sensitive data are sent to third-party providers (OpenAI, Anthropic, etc.)
• Use on-premise providers (Ollama, vLLM) for sensitive environments
• SSH session content is never logged or transmitted outside your machine