Security

plumb runs commands your repository already declares, on your machine. That is a real surface, and this page says what it does about it rather than assuring you it is fine.

Nothing leaves your machine

No model, no API key, no network calls. plumb does not upload your code, your command output, your repository name, or a count of anything. There is no telemetry to turn off because there is none to begin with. It works behind a corporate proxy and on an air-gapped machine because it never wanted the network in the first place.

Credentials never reach your agent

Failing tests print a lot, and some of it is secret — CI logs leak credentials constantly. Anything plumb reports goes straight into an AI agent’s context and into whatever transcript that agent writes, so it is scrubbed first.

The name stays and the value goes, so DATABASE_PASSWORD=[redacted] still tells you what failed. And plumb reports how many values it removed, so you are never wondering whether output was quietly altered.

It only runs what your repository already declares

plumb does not invent commands. It runs what is written in your Makefile, your package scripts, your CI workflow — the same things a contributor would run. Reading is the default; execution takes an explicit check, and commands it cannot responsibly start on this machine are reported as blocked rather than run and guessed at.

Prose is read, never executed. plumb extracts what your documentation requires and quotes it with the file and line — but a sentence does not become a command because it contains command-shaped text. Execution comes only from the declared, machine-readable surfaces above.

Where that stops. Commands plumb identifies as rewriting your tree are refused — it recognizes them by name, so make fmt is skipped rather than run. It cannot know what a command called lint actually does without running it, and it does not sandbox anything. Running plumb check against a repository means trusting that repository’s declared commands exactly as far as you would trust typing them yourself. plumb refuses what announces itself; it does not promise your tree is untouched.

The detail

What gets removed from output

• Issued tokens in the formats used by the major code, cloud, payment and package-registry providers, plus signed web tokens.
• Any assignment whose name says the value is a secret — the value goes regardless of what it looks like.
• Credentials embedded in URLs and in authorization headers.
• Private key bodies.
• Credentials your check read from its own environment, removed by exact match rather than by guessing at their shape.

What it does not do

This reduces exposure. It does not guarantee output contains no secrets, and plumb does not claim otherwise. A credential fetched from a secret manager at runtime, carrying no recognizable format and no name beside it, is indistinguishable from a checksum. Finding it by randomness alone would also flag every hash in your test output and remove the file and line number plumb exists to report — a worse trade.

A redacted value can also hide the cause of a failure. If a check fails because a credential is wrong or expired, you will see the marker where the bad value was. Re-run the command yourself to see it.

There is no way to switch redaction off. That is deliberate: a flag for it would end up in a CI configuration and stay there.

Posture

• Third-party dependencies: none. The package pulls in no libraries, so its supply chain is the standard library.
• No state is written unless you ask for it. No logs, no cache, no config file appears on your disk by default.
• Compliance: no SOC 2 or ISO 27001 certification is held. Saying so is more useful than implying otherwise.
• Code signing: the macOS binary is signed with a Developer ID certificate and notarized by Apple — spctl reports source=Notarized Developer ID. The notarization ticket is not stapled to it, so a copy downloaded directly is checked online by Gatekeeper the first time it runs; files placed by the install script are never quarantined, so Gatekeeper is not consulted at all.

Reporting something

Email security@plumbing.sh. You will get a human reply. If you would rather not use email, say so on any other channel and a route will be arranged.

Buying for a team, or need this reviewed by your security people? support@plumbing.sh.