Know what runs on your machine.

Copperbar’s server listens on the loopback address by default. Protected API operations require the local API token. Keep that token private and retain the local bind setting for local use.

Worktrees are not security sandboxes

Agents and terminal commands run with your user permissions. A separate worktree keeps task files apart; it does not prevent a process from accessing other files, network services or credentials.

Review repository commands

Setup and archive scripts do not run automatically when a workspace is created or removed. Inspect commands before explicitly running them, especially in unfamiliar repositories.

Understand your provider

Agent CLIs use their own authentication and may send prompts, source files or other context to their providers. Review those providers’ permissions and policies.

Keep independent backups

Checkpoints and local metadata backups help recover work. Keep independent copies of valuable source files and push important branches to a repository you control.