Skip to content

Security: yaijs/prr-cli

Security

SECURITY.md

Security notes

prr is a local developer CLI. It reads files from your workspace, sends review or brainstorm requests to the configured OpenAI-compatible endpoint, and stores local artifacts under .prr/.

API keys

  • Configure credentials through environment variables such as NVIDIA_API_KEY or via a local .env file.
  • .env* files are git-ignored by default in this repo.
  • API keys are not intentionally written to persisted review artifacts.

File access boundaries

  • Reviewer tool calls are limited to workspace-relative file paths.
  • Paths that escape the current workspace are rejected.
  • Ignored locations such as .git and node_modules are blocked from tool-based file reads.

Network behavior

  • Requests go only to the configured provider endpoint from your config.
  • Provider requests use a configurable timeout.
  • prr doctor can verify endpoint DNS and API connectivity before larger runs.

Local artifacts and sharing

  • Review and brainstorm runs are stored locally under .prr/.
  • Persisted artifacts can include local file paths, endpoint hosts, model names, and normalized error details.
  • Review artifacts before sharing them outside your machine or repository.

There aren’t any published security advisories