How tCode protects your system

tCode is built around one rule applied consistently everywhere: anything that only reads runs immediately, since there is nothing to lose from that; anything that could change something waits for you.

The folder-trust check

The first time tCode runs in a given folder, it asks you to confirm you trust it, since from that point on tCode can read files, edit files, and run commands there. This is a one-time decision remembered per folder, not a prompt you see on every startup, and it exists specifically for the case where you might point tCode at a folder you downloaded or cloned without having reviewed it yet.

Its own configuration is off-limits to every tool

tCode's local settings and your account credentials live in ~/.tcode. No tool, read-only or permission-gated, can read from or write to that directory or anything inside it, including through an indirect path built to reach it another way. This is enforced at the tool level itself rather than left to the permission prompt, because there is no legitimate coding task that would ever need to touch tCode's own saved login token, so it is blocked outright rather than something you would have to remember to decline.

Credentials on disk

Your access and refresh tokens are stored in ~/.tcode/credentials.json, restricted to your own user account specifically: standard file permissions on Linux, and an explicit access-control list rewrite on Windows, so that even another local account on a shared machine cannot read it.

Permission prompts flag unusual destinations

Beyond simply asking before a write or edit, the permission prompt checks where the target path actually resolves to. If it is outside your current project folder, an absolute path or one built with .., the prompt shows an explicit warning with the resolved location rather than just the path as typed, so a destination that looks ordinary at a glance is not approved by accident.

One bad turn cannot end your session

If a tool call hits an unexpected error, it is reported back as a normal failed step, visible in the transcript, rather than crashing tCode outright. If something goes wrong at a deeper level than a single tool call, a short crash report is written to ~/.tcode/crashes with a reference ID you can share if you need to report it, and the session continues rather than exiting, so a single bug in one turn never costs you the rest of your working session.

Remote-triggered turns are held to a separate standard

A prompt sent from a paired browser tab does not inherit whatever auto-approve settings happen to be configured on the machine it triggers. Its permission requests are answered from the browser specifically, since a request that originated remotely does not carry the same trust as someone physically at that machine's keyboard, and treating it as equally trusted would defeat much of the point of asking at all. See Pairing a machine for the full mechanism.

Compiled distribution

The version of tCode installed through pip install tcode-cli is a compiled package rather than plain-text Python source, aside from two small entry-point files that carry no meaningful logic of their own. This is a distribution choice rather than a security control on its own, but it does mean the actual implementation is not something casually readable by opening the installed package's files in a text editor.

What tCode never does on its own

tCode never sends your code or your conversation anywhere beyond the tAI backend it is already talking to as part of a normal turn, and never modifies anything outside the current project folder unless a prompt explicitly asks it to and you explicitly approve the specific action. There is no background telemetry, no silent update mechanism that changes behavior without your knowledge, and no path by which a tool call can affect your system without first appearing in the visible transcript described in Outputs.

If you believe you have found a genuine security issue in tCode itself, rather than a question about how a specific feature behaves, the most direct path is through your tAI account's support channel at tai.artfical.com, the same place you would report any other account or product issue.