# Security notes
[Feature docs index](README.md) · [Repository README](../../README.md)
## Purpose
Keep credentials out of docs, sessions, transcripts, update flows, and provider-mismatched auth paths while understanding local tool boundaries.
## Details
- Do not commit `~/.magi-code/auth.json`, access tokens, refresh tokens, API keys, account ids, transcripts containing secrets, or live auth output.
- Use provider-keyed auth records so OpenAI API keys and Codex OAuth tokens cannot be confused.
- Prefer environment variables for short-lived local smoke tests and `~/.magi-code/auth.json` with restrictive permissions for longer-lived local use.
- On Unix, `auth.json` must be owner-only (`0600` or stricter); CLI writes use `0600`, and symlinked auth files are rejected before parsing.
- Review tool calls and transcript output when working in sensitive repositories.
- Provider credentials are assistant transport credentials only. They are never used for Cargo, Git, or GitHub authentication.
- Set `MC_HOME` to an isolated directory when testing with disposable config/state.
- `read` URL resources fetch public HTTP(S) only: no auth/custom headers/cookies/body, no redirects, no JavaScript rendering, 512 KiB download cap, 48 KiB redacted output cap. It rejects private, loopback, link-local, unspecified, and multicast resolved IPs before network access and pins validated DNS addresses into the request.
- `bash` / `shell` has guardrails but no OS-level isolation. Use additional sandboxing for hostile repositories or untrusted prompts.
---
[Back to feature docs](README.md) · [Back to repository README](../../README.md)