Hop/wiki/Security-and-Privacy.md

Security and privacy

Local data

Hop stores state in the project under .hop/. Prompt text, source trees, commands, and check output are local unless the project or its filesystem is copied elsewhere. SQLite data is not encrypted at rest.

.hop/ is excluded through .git/info/exclude, so ordinary Git operations do not publish it. Initialization refuses to hide a .hop directory that the project already tracks.

Credential redaction

Before persistence, Hop redacts high-confidence provider keys, contextual tokens/passwords, private keys, authorization headers, and credential-bearing URLs. The same sanitizer is applied to proposal summaries and recorded check commands/output.

Detection is defense in depth, not a guarantee. Use environment variables or a secret manager. Rotate any real credential pasted into any agent prompt even when Hop reports a redaction.

Installer and release integrity

Packaged installers download checksums.txt from the same published Gitea Release and verify the selected archive before extraction. Gitea Releases are created as drafts, after race tests, vetting, and cross-platform builds, then must be reviewed before publication.

For stronger provenance before general availability, the release owner should sign checksums.txt with an offline-controlled release key and publish the public key independently. Checksum signing is listed as a launch gate in the release checklist.

Release-machine trust

Release builds execute on a maintainer machine, not on the Gitea server. Use a trusted, patched machine; keep the release token out of shell history and source files; scope it to the Hop repository; export it only for the publish command; and unset it immediately afterward. Releases upload as drafts for review. The token must be provisioned by the user outside the agent session: Hop and its agents never create, rotate, list, or revoke provider account tokens.

Filesystem safety

Hop does not use reset --hard, move the active branch, or write the user's real Git index. Visible-root synchronization fails closed when files, ignored destinations, or staged state could be overwritten.

Automatic push delegates authentication to the user's existing Git transport and credential configuration. Hop does not store remote passwords, SSH private keys, or access tokens. It disables terminal credential prompting in the background push path and redacts detected credentials from returned errors.

Reporting a vulnerability

Before the public security contact is configured, disclose vulnerabilities privately to the repository owner rather than opening a public issue. Add a SECURITY.md with the final contact before the first public release.