# Security Policy

## Trust boundary

Workbench is a native Pi extension and runs with the operating-system permissions of the Pi process. Project trust, tool descriptions and included Skills are not a sandbox. Review the source before installing it.

The authoring workflow requires authorization for every edit and successful pre-edit archival for existing Pi originals outside Git. The archive helper resolves symlinks and skips repository targets and files outside the Pi agent directory without creating archives. Repository membership is an exemption, not proof that a file is committed or remotely backed up. These are not universal interception of file tools. Archive and settings helpers validate their inputs; they do not establish authorization for a path or action.

## Data and model context

Workbench supplies its guides and tool results through Pi's normal model context and session handling. Results can include absolute source paths, documentation excerpts, archive locations and retention settings. Subsequent source reads may send file contents to the configured model. Choose model and session-storage policies appropriate to those files.

Supporting data is stored under `<Pi-agent-directory>/workbench/`:

- `piquickdoku.sqlite` indexes the locally installed Pi documentation.
- `settings.json` stores the backup-retention setting.
- `backups/v1/` contains gzip copies of explicitly archived originals and reversible source-path metadata.

Gzip is compression, not encryption. Backups can contain sensitive source material and reveal its original path. The helpers do not encrypt archives or preserve file permissions, ACLs and modification times as a recovery contract. Protect the agent directory accordingly.

## Automatic retention

An explicit Workbench start also begins background cleanup of expired own archives. The default retention is 30 days. No extra cleanup confirmation is requested. Only the supported own-archive format is eligible; unrecognized files and symlink targets are preserved. Format recognition is not cryptographic proof of authorship or protection from arbitrary concurrent filesystem replacement.

Cleanup errors do not prevent conversation startup. Already completed deletions are not rolled back. Shutdown cooperatively aborts and awaits retention; it terminates and awaits an active index worker. See the [full retention contract](guides/pi-authoring.md#backup-retention-and-explicit-starts).

## Reporting a vulnerability

Report sensitive findings privately through the trusted channel from which you received Workbench. If no private contact route is known, open an issue requesting one without including exploit details or sensitive data.

Include the affected Workbench, Pi and Node versions, a minimal reproduction and the expected impact. Do not include credentials, private prompts, transcripts or archive contents in a public report. Coordinate disclosure before publishing details that could expose users.

Security fixes target the latest released version. No support period or response-time guarantee is promised for older versions.

## Validation boundary

Local functional checks exercise native Pi loading, tool/message integration, filesystem operations, SQLite and worker lifecycle with isolated data and declared provider test doubles. They do not establish a sandbox, adversarial-model safety or a real interactive end-to-end guarantee.