# Security

Pi extensions and tools run with the local user's system permissions. This connector is not a sandbox.

- Restrict `allowUsers`, `allowChats` and `admins` before sharing the bot. A group mention is a routing condition, not authorization.
- The inherited default tool policy is `relaxed`; use `/feishu config permissions.policy=strict` for tool approval. A destructive-command blacklist is not a complete security boundary.
- Keep app secrets and model credentials in protected local configuration. Do not send API keys through group messages.
- Protect `~/.pi/agent/feishu-link/` (or `PI_FEISHU_LINK_HOME`) and Pi session files. Logs, outbox entries and conversation histories can contain private content.
- Package replacement and removal preserve user data. Stop the daemon before migration; back up first and delete retained data explicitly when no longer needed.
- Review diagnostic bundles before posting them publicly. Never attach live configuration, tokens, full chat logs or session histories to an issue.
- Rotate any exposed credential with its issuing service.

Report suspected vulnerabilities privately through this repository's GitHub security reporting channel when enabled. For public reports, include only sanitized reproduction steps and fake identifiers.