Security

The idea

Piye's agents read files, run commands and use the web, on your real computer. So Piye puts a few firm rules around them, and asks you at the moments that matter, without stopping ordinary work.

Trusting a folder

When you open a folder in Code that came from outside Piye (a clone, a download, a zip), a small card asks once: Trust this folder?

Until you trust it, Piye reads and edits it normally but runs none of its programs: no type check or lint, none of the project's own tools, no MCP servers it lists, no Git actions on your behalf. Once you choose Trust, they start.

• Your own projects, and projects Piye made, never ask.
• Visual never asks: an app opened in Visual is trusted, so people who don't write code never see the card.
• Turn the question off in Settings, Developer, Privacy & Security, Ask before trusting a folder.

The command sandbox

The Code agent runs commands in a sandbox, so a command can only write inside the project and the tools' own caches, and never reads the places where your computer keeps its secrets (cloud logins, SSH keys and the like).

Where there's no sandbox, Settings says so, and a command that leaves the project still waits for your OK. A command that must write outside the project shows a card and runs only after you approve it.

Turn the sandbox off in Settings, Developer, Privacy & Security, Agent commands in a sandbox (commands then run as your own terminal would).

What always asks first

In every mode, Auto included, these wait for your click, marked Dangerous where they can't be taken back:

• Pushing to Git, deploying and publishing.
• Commands with rm or sudo, and anything that can delete database data.
• A program's own delete command (removing a container, a virtual machine, an image).
• Changes to secret files like .env.
• A command that changes a folder outside the project, or that runs outside the sandbox.
• Working in another project from the same chat: asked once per chat.

In Review mode (the Code agent's default), every file change, delete and command waits for you. In Auto, edits apply as they land and a file the agent deletes goes to Piye's trash, so it can be restored; every change keeps its Undo. See Review, Auto and undo.

"Send data out?"

Text the agent reads (a README, a web page, a reply from a connected service) could try to trick it into sending your files somewhere. So:

• When the agent wants to open a web address that carries data (a long query, a code or key in the address, a password in the link), Code shows a card: Send data to (site)? with Allow once, Always for this site and Don't send.
• Plain addresses never ask: a docs page, a search, a short link. Well-known docs, package and code sites never ask at all, so normal lookups don't stop.
• The first time the agent uses a tool from a connected MCP server in a chat, it asks (Allow once, Allow for this chat, Don't), unless the server marks the tool read-only.
• Everything the agent reads from the web or an MCP server is labelled as outside text: information, never instructions from you.

In Visual, which never stops for a card, an address that carries data simply isn't sent, and the agent is told why.

Your secrets

• API keys, sign-ins and deploy and store keys live in your computer's secure storage (Keychain on a Mac, the keyring on Linux), never in your project.
• .env files are read as names only. Their values never go to the AI, and key-shaped values are masked in what the agent reads.
• Handoff never sends .env files, keys or certificates.
• Live keys for published apps are kept in your computer's secure storage and sent only to your host when you publish.

Rules the agent saves

When the agent saves a working rule or a note for later chats, it shows in the chat as its own line, with Undo. Rules that arrived with a repository (a clone, a pull) are treated as the project's text, not as your instructions.

The app itself

• The Mac app is signed and notarized by Apple.
• Every window is isolated: web pages and app previews shown inside Piye can't reach Piye's own controls.
• Your apps running on this computer can use the camera and microphone in Piye's previews (so a QR scanner works); other websites can't.
• A release of Piye signs in to piye.dev only.
• Tools Piye downloads for you are pinned to known versions and checked before use.

Report a security problem

Write to security@piye.dev. Please include what you saw and how to reproduce it.