# Security model
`jan` is not a constrained command runner. It is a **YAML-defined process launcher**. Any preferred tree (`jan use`) can define arbitrary `exec` argv, environment variables, and nested `include:` files. After `jan use`, every subsequent `jan <cmd>` trusts that tree **with no signature, content lock, or per-run prompt**.
!!! danger "Treat preferred directories like `PATH` or shell startup files"
If you install someone else's scripts bundle and run `jan use` on it, you have given them code execution under your user account.
The engineering review with findings, residual risks, and mitigations lives in [`SECURITY.md`](https://github.com/patbeagan1/Open-Source-Requests) in the crate root. This page is the operator-facing summary.
## Trust boundary
| `jan use <DIR>` | Sticky: later `jan` commands execute whatever YAML is currently at that path |
| Local `include:` | Confined to the preferred tree; included YAML has the same authority as the root |
| Remote include / `exec.url` | HTTPS (HTTP only with `--allow-http` / `JAN_ALLOW_HTTP`); **required** `sha256` |
| `jan bundle` / `jan-install.sh` | Manifest hashes are **integrity** checks, not publisher authentication |
| `jan alias` | Short names that still invoke the preferred tree |
| SQLite audit DB | Mutable local telemetry; may contain CLI secrets; not a security log |
Hashes detect corruption or unexpected content changes. They do **not** prove who published the tree.
## What jan does not do
- Sandbox child processes
- Drop privileges
- Verify publisher identity
- Prompt before each leaf execution
- Cap YAML size or include depth (a huge tree can use a lot of CPU/memory)
## Practical rules
1. Only `jan use` a directory you would add to your `PATH` or `source` as a shell script.
2. Review extracted bundle YAML **before** `jan use`. The installer deliberately does not activate the tree.
3. Prefer `env.private` and `env.pass` for secrets. Public YAML `env:` values are stored in the spec.
4. Do not pass tokens on passthrough argv if you keep the audit log enabled — they are stored in `argv_json`.
5. Protect `~/.config/jan-cli/config.json`. Anyone who can rewrite `jan_dir` redirects all future invocations.
## Remote fetches
- Default: HTTPS only, 20 MiB max object, 20s timeout, 24h TTL cache under `~/.cache/jan/` (mode `0700` on Unix).
- `jan use https://…/bundle.zip --sha256 <64-hex>` unpacks under `~/.cache/jan/trees/<sha256>/`.
- Bundles cannot contain remote includes — vendor YAML locally first.
## Related
- [Portable trees](PORTABLE_SCRIPTS.md)
- [jan use](cli/use.md)
- [jan bundle](cli/bundle.md)