# Security and privacy

[Documentation index](README.md) · [Commands and configuration](commands-and-configuration.md) · [Project security policy](../SECURITY.md)

## Trust model

Pi packages are executable code, not sandboxed documents. This extension runs with the permissions of the user running Pi and imports Pi-provided APIs. Review the source and a pinned release before installation. Project-local packages also participate in Pi's project trust flow, but trusting a project is not an operating-system sandbox.

Pi Rich Questions reads the current session branch when `/rich-questions` needs the latest completed assistant text. It writes one global preference file for extraction configuration. It does not implement shell execution, network clients, or credential storage itself, but selected model providers perform network requests through Pi.

## What leaves the machine

### Direct tool form

`ask_rich_questions` renders the question content already present in the active model/tool interaction. The extension does not make a separate extraction request. Submitted answers become a Pi tool result and are therefore available to the active conversation/model according to Pi and provider behavior.

### Slash-command extraction

`/rich-questions` sends the **complete latest completed assistant text** to the selected extraction model. If a dedicated model fails, the same text may be sent to the current session model as a retry. Provider routing, retention, region, logging, pricing, and policy are controlled by Pi/provider configuration—not by this package.

After submission, the formatted answers are sent as a displayed custom message that triggers the next turn in the active session. The result repeats all presented options and relevant form context, so sensitive question content can be present alongside the user's answers.

## Configuration and credentials

The versioned `pi-rich-questions.json` preference stores only mode or provider/model/thinking identifiers. It is created with mode `0600` where supported and replaced atomically. API keys, headers, OAuth state, and provider environment values remain managed and resolved by Pi. Never add credentials to the package repository, form schema, diagnostics, or issue reports.

## Handling sensitive prompts and answers

Before opening or submitting a form:

1. confirm the active session provider is approved for the data;
2. for `/rich-questions`, also confirm the configured extraction provider;
3. avoid entering passwords, API keys, private keys, authentication tokens, recovery codes, or regulated data unless the entire configured workflow is explicitly approved;
4. prefer a local/offline provider where appropriate and supported by Pi;
5. cancel with `Ctrl+C` if the displayed context contains data that should not be sent onward.

The broad fallback avoids an additional model call after extraction failures, but displays the complete source text locally and submitted answers still return to the active conversation.

## Safe diagnostics

For bug reports, share package/Pi versions, operating system, terminal, dimensions, command path, provider/model identifiers if non-sensitive, and a synthetic minimal reproduction. Redact:

- prompts, options, answers, and assistant messages containing private data;
- API keys, tokens, cookies, headers, environment values, and settings files;
- usernames and filesystem paths when they reveal identity or infrastructure.

Do not enable raw provider/request logging merely to report a UI problem. If logs are essential, reproduce with synthetic content and inspect them before sharing.

## Vulnerability reports

Do not open a public issue for a suspected vulnerability. Follow [SECURITY.md](../SECURITY.md), which prefers GitHub private vulnerability reporting for this repository.