Trust boundaries
QZX security model
QZX is a local command interface, not a sandbox. It runs with the permissions of the current user, and several documented commands can change files, processes, repositories, remote targets, or other system state.
The central rule
Treat every agent-selected command and argument as an operation that still needs normal authorization. Structured output improves observability; it does not make a dangerous action safe.
Read-only and mutating commands
Each command reference page declares the current classification. Mutating examples include file creation, deletion, permission changes, formatting, scaffolding, process termination, deployment, and release workflows. Check the exact page before execution.
Dry-run and apply
Dry-run is command-specific, not a universal QZX guarantee. repairWorkspace is dry-run by default and requires both --dry_run False and --apply True to modify files. Other commands have different defaults or no dry-run parameter.
Native execution
commandsBridge now permits only a bounded diagnostic allow-list, disables shell expansion, limits output, and stops commands after 30 seconds. High-risk filesystem mutations create a recovery archive first; --dangerously-bypass-approvals-and-sandbox/--yolo skips it. Actions such as runScript that lack a restorable path require the flag. It is not an operating-system security boundary.
Network behavior
Network commands can perform DNS, TLS, URL, speed, configuration, download, health-check, or deployment requests. In addition, the CLI schedules one pseudonymous version-activation event unless telemetry is disabled.
Paths, links, and permissions
Path normalization, recursive traversal, symlink handling, overwrite behavior, and privilege requirements vary by command. QZX does not currently publish one blanket guarantee for every operation. Review the command parameters, source, and dry-run output.
Threat model
The expected caller is a trusted local user or automation acting within that user's authority. QZX does not isolate an untrusted model, validate the business intent of an action, or replace operating-system access controls, backups, code review, or explicit approval.
Pseudonymous CLI telemetry
By default, QZX schedules at most one version_first_run event per QZX version and random local installation identifier to https://qzx.yumbale.com/api/v1/telemetry. It includes random installation and event UUIDs, QZX/Python/OS details, virtual-environment and known-CI flags, CPU architecture, server receipt time, and the IP observed by the server. It excludes commands, arguments, terminal input, paths, environment values, usernames, hostnames, file names, contents, process lists, and hardware serial numbers.
QZX_TELEMETRY=0 qzx WelcomeDO_NOT_TRACK=1 qzx WelcomeQZX_TELEMETRY=0 or DO_NOT_TRACK=1 disables collection; an explicit QZX_TELEMETRY=1 takes precedence over DNT. Network or storage failures never change a command result, and an unsent event can retry later. Raw IP addresses are retained for 1,825 days; deletion requires the random installation UUID from local state and must be requested privately. Local state can be redirected with QZX_TELEMETRY_STATE_DIR. Read the complete telemetry and deletion policy or inspect the implementation.
Reporting a vulnerability
Use the private contact route for sensitive reports. Do not paste credentials, exploit material, private paths, or installation identifiers into a public issue.