Security and data
- 01Secrets: never let them pass through, never display them in the clear8 min
A secret pasted into a conversation, even briefly, stays present afterwards in the logs and in any automatic review of the history, and a configuration command run for one precise purpose can display a neighbouring secret in the clear if its filter is too broad.
- 02A committed secret is burned: rotate it now, never by the date7 min
A secret tracked by a repository is treated as compromised from the moment it is written, not when someone proves it has been read, and the fix that reaches every copy is to rotate the identifier, with history rewriting coming second and not always necessary.
- 03Pseudonymous and anonymous are two different things7 min
A reference number used in place of a name remains personal data as long as a correspondence table exists somewhere, which can make the recipient a processor depending on its actual role rather than a simple case of anonymisation, and a pseudonymous identity on a repository needs its own local configuration.
- 04Auditing a skill before installing it8 min
A dated study found a security flaw in more than a third of a large sample of third-party skills, and the vast majority of confirmed malicious cases went through a hidden instruction, and two real vulnerabilities let a malicious repository execute before any confirmation at all, which leaves quarantine, full reading and systematic scanning as the only reliable protocol.
- 05What an agent can leak without being asked to9 min
An indirect prompt injection hides an instruction inside content the agent reads rather than in what you typed, a generated file has no author who stands behind its content, and a configuration rule that targets a file path is accepted without error while blocking nothing for the tool that runs direct commands, whereas a rule that targets that tool's name blocks it for real.
- 06Responsible automation: reversible first, failure reported, fix requested8 min
An irreversible action waits for a human checkpoint before executing, but this checkpoint is automatic only in the Manual permission mode, the most cautious of the six documented modes: on paid plans a session nonetheless starts in auto mode by default, and several of these modes approve file commands inside the working folder in advance, deletion included, which shifts responsibility for the checkpoint onto whoever designs the automation.
- 07What leaves the machine, what gets archived, what never gets shared8 min
A request sends the prompt text and the model's responses over the network, encrypted in transit, and the local copy of that exchange then stays readable in plain text on disk for a duration fixed by default; deleting a file leaves no way back, whereas archiving it keeps it available and reversible; and an internal document rich in detail becomes dangerous the moment it leaves, for the very reason that makes it useful internally, which calls for a raw inventory followed by an adversarial re-read before any sending.