# Security

Model Jury is decision support. It never applies a recommendation, edits project files, installs software, commits, pushes, deploys, or sends deliberate network mutations. Provider calls are the only intended network activity. Run artifacts are written with owner-only file permissions beneath the configured Model Jury directory.

Prompts sent to every seat prohibit tool use and mutations. GLM and DeepSeek seats call `ctx.llm` without tools. The Codex seat uses the first-party one-shot app-server provider with `permissionMode: never`; the current public provider API cannot force `sandbox: read-only`, so Codex confinement also depends on the user's native Codex sandbox configuration. This limitation is reported by `/jury doctor` and in `PRE_FLIGHT.md`.

Credentials stay in DSH credential and provider services. The plugin configuration contains credential references only indirectly through the selected provider route. Persistence recursively redacts fields whose names indicate keys, tokens, secrets, passwords, authorization, cookies, or credentials. It never serializes environment snapshots, headers, OAuth state, or provider request bodies.

The plugin stores only final structured model responses, safe call metadata, protocol prompts, aggregation data, and the user-visible report. It does not request or store hidden chain-of-thought.