Security and privacy

Local authoring

Parsing, validation, formatting, normalization, and project resource analysis run locally. The DSL is data and is never evaluated as code. Includes are limited to regular .plan files inside the project source root and have bounded depth, count, and total bytes.

planq format is the only normal command that writes canonical plan source. Mutation commands validate a complete candidate and commit atomically; a failure does not leave a partial edit.

Local preview

planq dev binds a loopback Bridge. The hosted workbench receives read-only snapshots through a short-lived connection described in the URL fragment. Fragments are not sent to the hosted HTTP server. The workbench cannot write the local source.

Treat a live preview URL as sensitive because its fragment carries temporary connection data. Stop the CLI process when the session is no longer needed.

Project files and credentials

Commit author intent and reviewed shared data:

• *.plan
• plan.manifest.json
• resources.plan
• resources.lock.json
• an intentionally installed .agents/skills/plan-gantt/
• intentionally installed .claude/skills/plan-gantt/SKILL.md and .trae/skills/plan-gantt/SKILL.md forwarders

Do not commit:

• .plan/
• Account CLI tokens
• Bridge URLs or tokens
• package-manager publication credentials

resources.lock.json excludes Workspace IDs, account IDs, email addresses, origins, and tokens.

planq skill install writes only these three project paths and temporary siblings under their project skills/ parents. It does not write user-Home Agent directories, .codex/skills, editor settings, shell profiles, or credentials. Existing conflicts are reported with Git-root-relative paths and are never force-overwritten.

GitHub sync

The GitHub App requests read-only metadata and repository contents for selected repositories. Sync reads the configured branch and manifest, validates the commit, and stores normalized results and source metadata. It cannot modify the repository or create commits.

Documentation site

The documentation build uses local static search. It does not load third-party analytics or remote search scripts, and searching documentation does not send queries or Plan content to an external service.