[{"data":1,"prerenderedAt":126},["ShallowReactive",2],{"docs-\u002Fdocs\u002Fsafety\u002Ftrust-and-privacy":3},{"id":4,"title":5,"body":6,"description":118,"extension":119,"meta":120,"navigation":121,"path":122,"seo":123,"stem":124,"__hash__":125},"docs\u002Fdocs\u002Fsafety\u002Ftrust-and-privacy.md","Trust & Privacy",{"type":7,"value":8,"toc":110},"minimark",[9,13,22,27,38,41,49,53,56,85,91,95,103,107],[10,11,5],"h1",{"id":12},"trust-privacy",[14,15,16,17,21],"p",{},"The TheGitAI CLI is ",[18,19,20],"strong",{},"source-visible"," so you can inspect it and verify how it\nbehaves on your machine.",[23,24,26],"h2",{"id":25},"trust-model","Trust model",[14,28,29,30,33,34,37],{},"The client is ",[18,31,32],{},"untrusted"," for security enforcement. All authentication,\nauthorization, rate limiting, and permission decisions are enforced\n",[18,35,36],{},"server-side",", and the server's enforcement is authoritative regardless of any\nclient-side state.",[14,39,40],{},"Any security-sensitive check in the client is a convenience hint, not a security\nboundary — don't rely on the client to enforce security properties.",[14,42,43,44,48],{},"When an approved ",[45,46,47],"code",{},"sudo"," command asks for a password, the prompt is local to the\nterminal UI: the client shows the exact command, masks the typed password, and\ndoes not send the password to the model or server.",[23,50,52],{"id":51},"what-lives-on-your-machine","What lives on your machine",[14,54,55],{},"The client stores only local, user-machine state:",[57,58,59,66,72,78],"ul",{},[60,61,62,65],"li",{},[45,63,64],{},"auth.json"," — your local auth token.",[60,67,68,71],{},[45,69,70],{},"models.json"," — locally cached model list.",[60,73,74,77],{},[45,75,76],{},"prompt-history.json"," — global prompt-only history, capped to 15 entries.",[60,79,80,81,84],{},"Repo-scoped saved session snapshots under ",[45,82,83],{},"sessions\u002F",", including the\nconversation history and the local session state needed to resume.",[86,87,88],"tip",{},[14,89,90],{},"Because the client is source-visible, you can read exactly what it does before\ntrusting it with your repo and shell.",[23,92,94],{"id":93},"terms-of-service","Terms of Service",[14,96,97,98,102],{},"Your use of TheGitAI is governed by our ",[99,100,94],"a",{"href":101},"\u002Fterms",", which set out\nyour responsibilities, explain that AI output and agent actions must be reviewed\nbefore you rely on them, and describe the limits of our liability for data loss or\nexposure.",[23,104,106],{"id":105},"account-security","Account security",[14,108,109],{},"Accounts are protected by a password-strength policy (weak or common passwords\nare rejected) and by email verification: a new account must confirm its email\naddress before it can sign in or authorize the CLI.",{"title":111,"searchDepth":112,"depth":112,"links":113},"",2,[114,115,116,117],{"id":25,"depth":112,"text":26},{"id":51,"depth":112,"text":52},{"id":93,"depth":112,"text":94},{"id":105,"depth":112,"text":106},"The client is untrusted by design — the server is authoritative, and only local state lives on your machine.","md",{},true,"\u002Fdocs\u002Fsafety\u002Ftrust-and-privacy",{"title":5,"description":118},"docs\u002Fsafety\u002Ftrust-and-privacy","Bqmbw5HMhPO5-jqJ1lg9TSSTMKVF2sxr3uYI34nLdX8",1781201395984]