# Security
## Trust model
`oy` is not a sandbox. It adds a coding agent and repository review workflows to OpenCode.
OpenCode and the user control models, provider credentials, permissions, edits, shell commands, web access, and sessions. The `oy` plugin does not add permission overrides.
The oy CLI can:
- read eligible files inside the selected workspace;
- run read-only Git commands for target-diff reviews;
- write `.oy/runs/` evidence, reports, and private workflow metadata;
- update OpenCode configuration during explicit setup or upgrade;
- launch OpenCode and optional mise-managed installers.
Prepared source text may be sent to the model provider configured in OpenCode. Treat prompts, reports, OpenCode logs/sessions, and setup backups as potentially sensitive.
## Safer use
- Review [`docs/install.sh`](docs/install.sh) before piping it to a shell.
- Run `oy setup --dry-run` before changing an existing OpenCode configuration.
- Configure OpenCode permissions for the repository you are reviewing.
- Use a disposable container or VM for untrusted repositories.
- Do not mount the host Docker socket into an AI-assisted container.
- Do not keep secrets under the workspace root solely because secret-like filenames are excluded from collection.
- Inspect generated findings before publishing or uploading them.
Setup backs up changed oy-owned configuration and files before replacing them. A machine crash can still interrupt the operation, so keep the reported backup until the new setup is verified.
## Report a security problem
Open an issue in the public GitHub repository:
https://github.com/adonm/oy-cli/issues/new
Include the affected oy/OpenCode versions, operating system, reproduction steps, impact, and relevant logs. Redact credentials, authorization headers, prompts, private source code, session contents, and local paths that should not be public.