verdict runs on one user's machine, reads that user's local transcripts, documents and git history, and writes a records file. It makes no network calls of its own. This page lists what it protects, what it does not, and how to configure it safely.

• Records file. It holds the text of prompts, notes and documents that passed the credential filter, with their source positions. It is written atomically (temporary file, then rename). Its mode comes from the umask. Treat it as sensitive. Restrict its directory, or set a stricter umask.
• Credential filter. Text matching a built-in or configured credential pattern is dropped before a record is written. This applies to typed prompts (Claude Code and Codex), curated memory and instruction edits, and Markdown documents. Add patterns with credential_patterns in the config file (see README). The filter is an approximation. A secret without a recognizable shape is not caught.
• Quotes. A quote is read from the transcript or document file named in the record, but only when the file lies under a transcript directory or a configured document root, after symlinks are resolved. Otherwise the stored text is used. This stops a crafted records file from making verdict read an arbitrary file.
• Git. Commands run with argument arrays, never through a shell. Only the configured repositories are read.

• Default bind is 127.0.0.1. Wildcard addresses (0.0.0.0, ::) are refused.
• A non-loopback address requires --token-file. The token file must not be readable by group or others (mode 0600 or stricter). The bearer token is compared in constant time, and its value is never printed.
• Requests carrying an Origin header are refused, which blocks browser-driven cross-origin requests.
• Request bodies are capped at 4 MiB. The HTTP server sets a header read timeout.
• The service has no TLS. Run it on loopback, or behind a network path you trust.

• The hook reads at most 4 MiB from stdin. Larger input is refused.
• Any failure (missing binary, missing records, timeout, bad JSON, non-zero exit) prints nothing and exits 0, so a broken setup never blocks a prompt.
• The optional hook_personas list limits which sessions are hinted. It is off by default.

Quotes and MCP results are text from the user's own history. They are untrusted data. The hint tells the model the records are reference only, but nothing in verdict sanitizes them. Do not let recalled text grant permissions or change instructions.

• Secrets that do not match a pattern.
• Other users on the same machine who can read the records file or the config.
• Network exposure, if you bind a non-loopback address and misconfigure the token.
• Transcripts from other tools. Only Claude Code and Codex formats are read.

There is no public issue tracker for this copy yet. Report security problems to the maintainer privately.