# Security

[Docs](https://www.rightnowai.co/docs) / [RightNow Agent](https://www.rightnowai.co/docs/agent) / [Security](https://www.rightnowai.co/docs/security)

Updated 2026-10-17

> **Release status**
>
> RightNow Agent, the terminal coding agent, is paused. Its guides stay online as reference.

Read this before connecting a provider or letting the agent run tools in a repository.

The shipped configuration sends prompts and relevant tool results to RunInfra at `https://api.runinfra.ai/v1`. RightNow Agent is not an air-gapped product.

On this page
- [Credentials](https://www.rightnowai.co/docs/security#credentials)
- [Network boundary](https://www.rightnowai.co/docs/security#network-boundary)
- [Permission decisions](https://www.rightnowai.co/docs/security#permissions-are-decision-gates)
- [Untrusted input](https://www.rightnowai.co/docs/security#untrusted-input-and-integrations)
- [Private reporting](https://www.rightnowai.co/docs/security#vulnerability-reporting-status)

## Build from source

The reference below describes a build from the pinned agent source.

### Credentials

- The shipped RunInfra provider preset reads `RIGHTNOW_API_KEY` and accepts `RUNINFRA_GATEWAY_KEY` as a fallback. Other featured provider presets use `CEREBRAS_API_KEY`, `GROQ_API_KEY`, `OPENROUTER_API_KEY`, and `AI_GATEWAY_API_KEY`.
- Direct Anthropic uses `ANTHROPIC_API_KEY`. Direct OpenAI uses `OPENAI_API_KEY`.
- The Connect screen probes keys before storage. A key may be stored when it is valid or when its provider is unreachable and the probe result is unknown.
- Stored keys use the first nonempty override, `RIGHTNOW_AUTH_PATH` then `GROK_AUTH_PATH`, or otherwise `<RIGHTNOW_HOME>/auth.json`. The agent attempts to set owner-only permissions. If permission tightening fails after writing or renaming, it logs a warning without failing an otherwise successful write.
- For a model credential, a nonempty `api_key` wins, then the first nonempty resolved `env_key`, then the selected provider's stored key.
- Keep credential values in the environment or the auth store, not in committed config, documentation, receipts, or shared logs.

Receipt projections omit header and query values, but the full effective sampling config contributes to a hash. Review every diagnostic artifact before sharing it.

### Network boundary

**Network and update controls**

| Activity or setting | Effect and boundary |
| --- | --- |
| Model requests | Model requests go to the selected provider. |
| Web tools | Web search and web fetch contact public sites when called. |
| Integrations | MCP servers, hooks, proxies, and custom providers keep their own command, network, and credential behavior. |
| Model catalog | `remote_fetch = false` disables optional model-catalog fetching only. |
| Telemetry | `telemetry = false` does not disable model or tool traffic and does not remove the local unified log. |
| Updates | Native updates follow the selected stable or alpha channel and verify the download against the release manifest, its SHA-256 sidecar, and the published size before activation. Native updates also verify the publisher signature before activation. `rightnow update --check --json` reports the decision without installing. |

### Permissions are decision gates

`--always-approve`, `--yolo`, and `--dangerously-skip-permissions` auto-approve tool execution. Do not use them for untrusted work.

> **Warning: Windows boundary**
>
> On Windows, permission prompts are application-level decisions, not kernel-enforced filesystem or network isolation. Use an external containment boundary when stronger isolation is required.

### Untrusted input and integrations

- Treat repository text, command output, fetched pages, MCP output, hooks, and migrated rules as untrusted input.
- Review commands, paths, destinations, URLs, headers, and environment values before approval.
- The shipped configuration disables machine-wide Claude and Cursor skill, rule, and agent imports. MCP migration is opt-in.

### Vulnerability reporting status

Report vulnerabilities privately. Do not open a public issue or publish reproduction details. Include the affected version and operating system, the impact, reproduction steps or a minimal proof of concept, and relevant configuration with credentials and personal data removed.

## Next task

[Choose permission rules](https://www.rightnowai.co/docs/permissions) before approving repository work.

## Previous

[Capabilities](https://www.rightnowai.co/docs/capabilities)

## Next

[Sandbox](https://www.rightnowai.co/docs/sandbox)