Security
What runs where, and what leaves your machine
Paqad runs on each engineer's machine and keeps its files in the project's repository. By default it sends nothing about your project to anyone. The connections a team configures, and a few optional features, contact outside services; each one is listed here with what it sends and how to turn it off.
Checked against the paqad-ai 1.91.1 source code on 25 September 2026. The place to start a team's evaluation of data flows.
Two different things
Paqad is not your AI coding tool.
Your AI coding tool (Claude Code, Cursor and so on) sends your code and prompts to its own provider, under your agreement with that provider. That happens with or without Paqad. Paqad adds instructions, rules and project context to what the tool already sends, so that extra text also reaches the provider. None of it goes to Eliyce.
What stays on your machine
| What | Where |
|---|---|
| Settings, records of each change, decisions and the audit log | .paqad/ in your project. Paqad writes its own .paqad/.gitignore so machine-specific parts such as session/, ledger/, vectors/ and secrets.env are not committed. |
| Project search index, if you turn project search on | .paqad/vectors/. It contains the indexed text as well as the numbers used to search it. |
| Downloaded search models, if you use the local option | ~/.paqad/models in your home folder |
| API keys for optional search providers | Environment variables, or .paqad/secrets.env stored as plain text with owner-only permissions where the system allows |
| Security review reports | docs/pentest/. This folder is outside .paqad/ and is not ignored by default, so decide whether you want reports committed. |
The local dashboard (paqad-ai dashboard) listens only on your own machine (127.0.0.1) unless you change the host yourself. It has no login, so do not expose it on a shared network.
What leaves your machine, and when
No telemetry. The source contains no usage tracking or analytics. The only network activity is listed below.
| Activity | When it happens | What is sent, and to whom | How to turn it off |
|---|---|---|---|
| Update check and background update | On by default, at the start of a session in Claude Code and Codex CLI, at most every 12 hours | A version lookup to the npm registry. If a newer release exists, it runs npm install -g paqad-ai@latest in the background | auto_update=false in .paqad/.config, or PAQAD_AUTO_UPDATE=false |
| Project search with OpenAI or Voyage | Only if you turn project search on and choose one of these providers | The text of each indexed passage and each search query, to that provider under your own API key | Use the local provider, or leave project search off (the default) |
| Project search with the local model | Once, when the model is first needed | A model download from the model host; afterwards it runs offline | Leave project search off |
| Security review | Only when you ask for one | Package names and versions to your package registry's audit service and to the OSV vulnerability database. Test requests to the application address you give it | Do not run it, or review the target address first |
| Codebase health check | Only when you run paqad-ai health run | Package details to OSV when osv-scanner is not installed, and a public Laravel upgrade guide download | --offline |
| Installing a pack from a repository | Only when you run paqad-ai packs install | A git clone from the address you give | Do not install remote packs |
| GitHub issues and pull requests | Only when you run intake or delivery commands | Issue reads, branch pushes, pull request creation, CI status reads and a pull request comment carrying the record, all through your own gh command line login, to the repository you name | Do not use those commands |
| Jira tickets | Only if your AI tool has an Atlassian MCP connection that you configured, and a request names a Jira key | The AI reads the ticket, and can transition, comment on or update it, through that connection under your own Atlassian account. Paqad itself makes no request to Jira; the command line only tells the AI to use the connection | Do not configure the connection, or do not reference Jira keys |
The MCP settings Paqad writes for your AI tools are lists of suggested servers with no start command. Paqad starts no MCP server and contacts none. See the MCP guide.
The record of a change stays in the repository unless your team sends it somewhere: posting it to a pull request happens through your GitHub login, and paqad-ai audit export writes it to a file for your own monitoring systems. Nothing is sent to Eliyce.
What the checks can and cannot stop
Paqad's strongest controls are hooks: small programs your AI tool runs automatically before an edit and at the end of a turn. Only some tools run them, and they have edges.
- Hooks run only in Claude Code and Codex CLI. Gemini CLI records after the fact. Every other tool receives instructions it can ignore. See integrations.
- Before an edit, hooks see the tool's file-editing actions. Commands the AI runs in a shell are not checked beforehand.
- Security review findings are reported, not enforced. Nothing blocks a change because of a security finding.
- Paqad does not stop destructive shell commands, database migrations or committed secrets. A script for this ships in the package but is not switched on.
- Some settings, such as the security escalation options, are not read by the current release.
paqad-ai config effectiveshows which settings have an effect. - Rule scripts, the checks generated from your team's rules, run as ordinary programs with your permissions. They are not isolated from your files or network. Review generated scripts as you would any code.
- The security review combines pattern-matching scripts with the AI's judgment. Its references to OWASP categories are a map for the reader, not proof of security or compliance with any standard.
- Anyone with access to the project can switch Paqad off with
paqad-ai disable. The record notes work done while it was off.
Read the details in guardrails, the security review workflow and how the checks relate to OWASP.
Checking the software itself
- The full source is public at github.com/Eliyce/paqad-ai under the MIT licence.
- The package is published on npm as
paqad-ai. The version you run is shown bypaqad-ai --version. - Every release is listed with its changes in the changelog.
- If you prefer to update deliberately, turn the background update off and pin a version.
npm install -g paqad-ai@1.91.1
# in the project: .paqad/.config
auto_update=falseReport a vulnerability privately
Please do not open a public issue for a security problem. Use one of these private routes, described in the project's security policy:
- A draft GitHub security advisory, visible only to the maintainers
- Email to haider@eliyce.com with the subject
[paqad-ai security]
Include the affected version, your Node.js version and operating system, and the steps to reproduce.