Concepts

Trust and safety Partly available

GitMaster is built so that every change to a repository has an actor you can identify. This page explains who may do what, what the app treats as untrusted data, what it runs, what it records, and where it keeps its data. The principles behind these rules are on the Principles page.

Effect levels#

Every action in GitMaster has one of three effect levels.

Who may do what#

Human actor#

You act through the window, the menus, the command palette and the keyboard. Each action runs when you start it. Destructive items in menus are shown in red. Those that discard work or delete something ask for confirmation first. Force-deleting a branch needs an explicit confirmation checkbox, labelled Discard commits that exist only on this branch.

Agent actor#

An agent that connects through the MCP server can read review comments and threads. It can record that it handled a review comment, attach labels, and link threads to each other. These writes go to GitMaster's own store. The server has no tool that edits, commits, pushes or deletes anything in the repository. What an agent records is yours to confirm in the app: a comment it marks handled stays open to you until you resolve it.

Untrusted data#

Some text in a repository is written by people or programs you do not control. GitMaster treats the following as data:

• commit messages
• branch names
• file contents
• the output of commands
• the text of threads: your earlier prompts, the agent's replies and the output of its tools
• the text of labels and review comments, which you or an agent wrote

The app displays this text, searches it and compares it. It never runs it.

Text in agent requests#

Text from the repository never becomes an argument of an Apply action unless a plan that you approved produced that action. Anyone who can write to a repository can write these strings, and an agent that reads them can be steered by text it did not write. A plan fixes the exact action before you approve it, so the text cannot change that action afterwards.

What GitMaster runs#

Git#

GitMaster runs git as a program with a list of arguments, never through a shell. Git runs its own hooks when you commit, such as pre-commit, just as it does on the command line.

Programs you configure#

Workflow scripts run in a sandbox, and they act only through the actions the app provides. A workflow step can run a program that you choose, such as a tool that writes a commit message. That program receives an argument list, never a shell, and it is stopped when its run is cancelled. Its output is untrusted data.

Approvals for workflows#

A workflow script runs only after you have reviewed it. Each version of a script is identified by its content. You review a version the first time it runs, and any edit, by you or by an agent, makes it unreviewed again. A run that you start by hand goes ahead, and a run started by an event waits for your approval at each Apply step, unless you have chosen automatic approval for that reviewed version. After a run has executed a program, its later Apply steps ask again, and the dialog shows the exact arguments. A run started by an agent always waits for you. See Approvals and security.

What GitMaster records#

Git commands#

Open the Git commands panel from the status bar. It lists every Git command that changes something that the app ran: stage, unstage, commit, checkout, fetch, pull, push, and branch and worktree operations. Each entry shows the program, its arguments, the exit code, the duration, standard output and standard error. Reads, such as status, diff and history, are not listed. The panel keeps the last 1000 entries in memory. Nothing is saved to disk, so the list is empty the next time you open the app.

Threads#

With the agent integration installed, GitMaster records each agent session in the repository as a thread: your prompts, the agent's replies, its tool calls and results, and every file edit. Secrets are removed before anything is stored. An agent can read threads through MCP. It can label and link them, but it can never change the text of a thread or delete one.

A thread is an observed record, not a tamper-proof one. An agent that runs as you can write to the same files as any other process.

Operation log#

The operation log records each operation that changes a repository, what was asked, and who asked for it: you, or an agent, shown as agent:<client> with the name of the client that connected.

Where data is kept#