Security and trust

Tatu runs commands and edits files with your permissions. Whatever your user can do in a terminal, the model can ask Tatu to do. Treat it like a colleague at your keyboard.

What the model can do

Run commands. The bash tool runs a command in bash (or sh if bash is not installed), in the project folder, with your whole environment. That includes variables such as ANTHROPIC_API_KEY if you export them.
Read and change files. The read, write and edit tools accept any path your user can reach: a relative path, an absolute one, or one that starts with ~/. They are not limited to the project folder.
Reach the web. web_search and web_fetch send queries and addresses to other services. See Privacy: what leaves your machine.

There is no sandbox, and there are no permissions per tool yet. Tatu does not ask before it runs a command or writes a file. A hook can answer permissionDecision: "ask" or "allow", but that changes nothing yet. What does work is a PreToolUse hook that blocks a call: it exits with code 2, or answers with a deny decision. See Hooks.

A repository is not you

Some files in a project are instructions for Tatu. Whoever owns the repository wrote them, and Tatu follows them as soon as you start it there:

Where	What it can do
`AGENTS.md` or `CLAUDE.md`, in the folder or in any parent of it	Goes into the system prompt: it can tell the model what to do. The files it imports with `@path` go in too, and an import can name any file you can read, inside the project or out of it.
`.tatu/settings.json`	Sets hooks (shell commands that run around tool calls and messages), extra system instructions, the model and provider, the vision model, the web services and the address of the model catalog. Only the `daemon` section is ignored there.
`.tatu/skills/`, `.tatu/prompts/`, `.tatu/agents/`	Add commands and subagents that tell the model what to do.
`.mcp.json`, in the folder	Lists MCP servers, which are programs. Unlike the rest, Tatu does not start them until you trust the project with `/mcp trust`.

A hook is a shell command. It runs on your computer, with your permissions, without asking. A cloned repository can contain one that reads your files or sends them somewhere.

Tatu marks the content of web pages as untrusted data for the model. That helps, but it is not a guarantee. Text in a file, a page or the output of a command can try to steer a model, so be careful with sources you do not trust.

Git publication and web previews

Publishing from the app asks you to review files and the destination before confirming commit, push or pull-request creation. This confirmation belongs to that app action; it is not a permission prompt for commands the model runs. A repository’s commit and pre-push hooks can run with your permissions. Read a clone’s Git hooks and configuration before publishing, as well as the Tatu instructions listed above. A failed push or pull-request step does not undo a completed commit.

CI logs and review comments are third-party content. The app marks them as untrusted when adding them to your message draft, but that is not a guarantee against instructions hidden in them. Review the text before sending it to the model.

A web preview shares only the local ports you explicitly publish with trusted paired devices; it does not create a public URL. Publish only servers you intend those devices to reach, and use a trusted device: the server may expose development data or actions. Encryption protects traffic through the relay, not the page’s own behavior. Closing a preview does not revoke its publication or stop the server. Revoke access when done, then stop the server separately. See Web previews.

Your credentials

Keys and sign-in tokens are stored in ~/.tatu/auth.json (in auth.json under TATU_HOME if you set it). Tatu writes the file with mode 0600, so only your user can read it. /logout removes a stored credential.
A key you export in your shell is not stored by Tatu. Commands the model runs inherit it.
Sessions in ~/.tatu/sessions/ hold everything said in a conversation, including the content of files and command output. They are created with mode 0600.
The log file is created with mode 0600 too. With -debug it records the arguments of every tool call, which may include a secret you typed in a command.

Do not commit ~/.tatu to a repository or share its files.