# Security Policy ## Trust model CommitMe is a Pi extension package. Pi extensions run with the full local permissions of the user account that starts Pi. Review extension source before installing it, pin versions in sensitive environments, and install only from trusted sources. ```bash pi install npm:@senad-d/commitme@ pi install git:https://github.com/senad-d/commitme@ ``` ## Runtime security behavior - `/commitme` is an explicit user-triggered commit command: it reads git/project context, drafts a bounded subject-line prompt with the active Pi LLM provider, validates and normalizes the final one-line subject, stages the gathered changed paths, and creates a local git commit with `git commit`. - `/commitme --confirm` requests confirmation before staging and committing. - Tool `action: "gather"` is read-only and returns compact commit context. - Tool `action: "commit", message: "..."` uses an explicit final one-line subject and creates a local commit without requiring model drafting. - Tool `action: "commit"` without `message` is an explicit user/agent-triggered one-shot commit path: it gathers context, drafts with the active Pi LLM provider, validates the subject, optionally confirms, stages gathered changed paths, and creates a local commit. - Commit actions prompt in UI-capable sessions before staging known secret files, unreadable changed files, or high-confidence secret tokens; declining blocks the commit. Non-UI commit actions still abort before staging flagged unsafe files. Commit actions also abort if the drafted subject cannot be validated after cleanup/retry/repair; they recheck the current working tree for unsafe content immediately before staging, stop if git status changes after context gathering, and avoid staging unrelated paths that appear after the final changed-file scan. - Oversized, generated, binary-looking, unreadable, renamed, symlinked, and symlink-aliased changed files are omitted from model context when appropriate; CommitMe still scans regular local file content for high-confidence secret tokens before staging, and unreadable changed files or symlinks to sensitive repository paths are treated as unsafe. - Commit-message confirmation is requested only when `--confirm` or tool `confirm: true` is set. Unsafe-file approval prompts are separate and appear only when flagged unsafe files would otherwise be staged in a UI-capable session. UI confirmation modes fail before context gathering or model drafting when no UI is available. - CommitMe never runs `git push`. - CommitMe does not send telemetry. - CommitMe does not call non-LLM network APIs. - CommitMe uses only the active Pi LLM provider for command and message-less tool commit drafting, including one safe retry or repair prompt when needed. - Drafting diagnostics are non-sensitive: they report stop reason, content block type counts, text length, token usage totals when available, and prompt truncation metadata. They do not include raw prompts, raw diffs, file contents, secrets, or raw model output. - CommitMe avoids intentionally reading secret files such as `.env`, `.envrc`, private keys, kubeconfigs, and credential stores. `.env.*` files are allowed by path, but their contents still pass through redaction and high-confidence token scanning. - Sensitive, generated, binary-looking, unreadable, overly large, symlinked, symlink-aliased, or secret-like changed-file contents may be listed by path/status but are omitted from model context. Generated and binary-looking regular files are still locally checked for high-confidence token patterns before commit actions stage changes; unreadable changed files require explicit UI approval because they cannot be scanned safely. - Diff excerpts are collected with Git external diff and textconv disabled, then filtered through path checks, content checks, and line-level redaction before they are sent to the active Pi LLM provider. ## Reporting vulnerabilities Please report suspected security vulnerabilities privately by email: . For non-sensitive issues, use the repository issue tracker: Do not open public issues for security-sensitive reports that include exploit details, private repository contents, secrets, or credentials. ## Secure development checklist - Do not commit secrets, tokens, local `.pi/` state, or generated artifacts. - Document any file, shell, network, or credential access added by the extension. - Avoid starting background resources in the extension factory. - Keep package contents minimal with `npm run check:pack`. - Use isolated smoke tests with `pi --no-extensions -e .`.