# Security model

Understand credentials, code execution, trust boundaries, and the merge boundary.

## Credentials

- CURSOR_API_KEY starts and resumes cloud agents.
- GITHUB_TOKEN reads PRs and checks and writes labels and comments.
- Private clone credentials are temporary and never enter clone URLs.
- Tokens are not included in migration prompts.

## Configured commands are trusted code

setupCommand and testCommand execute in a disposable clone. Treat patchflow.config.json as code: review changes to it and restrict who may edit the configuration used by unattended watch mode.

> Isolation protects the working tree, not the host account. Run PatchFlow in a dedicated CI worker or container for stronger process and network isolation.

## Human merge boundary

PatchFlow opens draft PRs and never merges. Repository branch protection and required human approval remain the final authority.

## Output handling

Gate output is truncated before storage, PR comments, and agent retry prompts. Avoid tests that print credentials; PatchFlow cannot reliably redact arbitrary application output.