Security model

Pond runs coding agents with your user account on your Mac. The main question for its design is: what can an agent do through Pond that you did not ask for? This page lists the threats Pond considers, where the boundaries sit, and the rules that hold everywhere.

What Pond protects

• your Mac, your repos and your git remote;
• your Claude sign-in and your attention;
• your safety settings, such as computer use, browser grants and Friends;
• the little that friends and the relay learn about you.

Who Pond defends against

Threat	Example
An agent on your Mac	It runs as your user, so it can open sockets and edit files in the Pond folder.
Hostile repo content	A branch carries a crafted .claude/settings.json, .mcp.json or CLAUDE.md.
Hostile web or screen content	A page or an app tells the agent to pay, send or delete something.
A friend or a friend's compromised Mac	Sends a hostile task, or floods you with items.
The relay or whoever runs it	Reads, withholds or replays items.
A network observer	Watches who talks to whom.

Trust boundaries

Boundary	How it is enforced
You and your agents	Only Pond.app's own signed process counts as your keystrokes. An agent's process may write only into its own terminals, and only as a guarded write that never types over your draft or answers a dialog. See Processes and IPC.
Agents and each other	Each socket checks the caller's process ancestry. An agent cannot act as another agent, on the browser, the screen or the feed.
Agents and your settings	Safety settings are sealed with a key in the Keychain. A hand-edited, replayed or deleted file reads as the safe value. See Storage.
Pond.app and macOS permissions	Accessibility and Screen Recording go only to the optional Pond Computer helper. Pond.app asks only for Notifications.
Your Mac and the network	Code and terminal text stay on your Mac. Friend items are sealed before they leave. The relay never holds a key that opens them.

What Pond never does

• Never pushes without your click. A push and a draft PR run only from your click after a confirm sheet that names the remote, branch and title. pond pr can only preview, and there is no MCP tool for pushing.
• Never force-pushes. Pushes use an explicit refspec, so a + or --force cannot be built. If the remote has commits the push would drop, the work stays local.
• Never lets an agent set what runs. The setup command and the run command are set only by you. A repo file cannot set them, and neither can an agent.
• Never lets an agent grant itself access. Browser origins, computer-use apps and consequence confirms are granted only by your click on a Pond sheet. Return never grants, and grant buttons have no keyboard shortcut.
• Never starts Claude Code with a permission-skipping flag. Claude Code's own permission prompts stay in place.
• Never changes your ~/.claude settings. Hooks live in a per-session settings file that is deleted when the session ends.
• Never writes terminal output to disk. It stays in the helper's memory.
• Never stores a token. Git and gh use your own sign-in.
• Never starts an agent from a friend's task by itself, unless you turned on Auto for that group, project and member, within its caps.
• Never downloads or installs updates. It shows a line, and you install the update yourself.

Hostile content

Pond cannot stop a model from being persuaded. It limits what a persuaded agent can reach:

• In the browser, an agent may use only the worktree's own dev addresses. Away from localhost, consequence words ask you first, and password fields are off limits.
• In computer use, some apps can never be granted, consequence clicks ask first, secure fields are off limits, and Esc stops every agent.
• For friends, tasks arrive cleaned and fenced, with a fixed preface. Pond checks a set of sensitive paths before it fast-forwards, takes or starts from a branch.
• Refusals and errors are fixed sentences. Text from a page, a screen or a terminal is never echoed back in them.

Strings from outside

Branch names, paths, titles and ids from outside are checked before use: length caps, allowed characters, no leading -, no .., no path under .git. Git runs as /usr/bin/git with a short fixed environment and no prompts. Git's error output never reaches the UI, because it can carry a URL with a token in it.