Security Boundaries

Core rule

Identify each trust boundary explicitly and apply least privilege at that boundary.

Contract

Treat downloaded content, repository files from unknown origins, generated shell text, archive members, plugin hooks, environment variables, and user-supplied paths as untrusted until validated for the operation being performed.

Prefer argument arrays over shell interpolation; validate archive paths; constrain write roots; avoid privilege elevation unless required; verify signatures/hashes for bootstrapped executables when feasible; preserve provider trust prompts unless the user has explicitly opted into the exact automation being installed.

Do not disable dangerous-command approval globally to remove one setup prompt. Scope consent to the known component or one installer process.

Security checks are part of correctness: a “working” installer that can overwrite arbitrary paths or silently trust future third-party hooks is not near-perfect.