pi-hud is trusted code inside Pi's process, not a sandbox. Its protection is deliberately limited to its own behavior: with the quota feature off (the default) there are no network requests, no credential reads, no prompt/session writes, no LLM tools and no shell execution. The optional quota feature (quota.enabled: true) deliberately narrows its own network surface: a fixed-origin read-only HTTPS GET per verified provider (currently https://open.bigmodel.cn for GLM), 5 s timeout, 256 KiB response cap, every redirect refused, credentials: "omit" (no cookies), no model-request probing, credentials resolved through Pi's own provider auth at query time (never stored in HUD config or caches, only an opaque non-reversible fingerprint as an in-memory cache key), and redacted diagnostics that never contain tokens, headers or raw responses. Git is opt-in and uses a fixed argument array without a shell. fetch may appear only inside the marked transport boundary of src/quota/transport.ts; scripts/check.mjs fails the build for any network call elsewhere. Config and display inputs are bounded; terminal escape/control/bidi sequences are removed from untrusted display text. API callbacks contain failures rather than writing raw output.

Configuration symlinks are supported for dotfile workflows; only point them at files you control. Quota profiles bind exact Pi provider IDs and may carry organization/project context — these are account identifiers, not credentials, but keep them out of shared repositories. Another loaded extension can emit bridge data or mutate shared process state, so the event bus is not an authenticated security boundary. An attacker with the ability to replace this package, its config, Node, or Git is outside this model. Optional Git's command timeout is best-effort; it cannot guarantee that a kernel-blocked filesystem operation instantly stops. The quota HTTP timeout is likewise bounded best-effort; late results are discarded by generation tokens.

Do not publish API tokens, transcripts, command contents, sensitive basenames, personal paths or raw debug dumps in issues. Provide a sanitized minimal reproduction and aggregate timing data. The HUD itself keeps basenames rather than full tool paths, but basenames and bridge labels can still be sensitive on a shared screen.

This delivery has no pre-created GitHub repository or private reporting endpoint. After publishing the repository, its owner should enable GitHub private vulnerability reporting. Until then, report privately to the maintainer through an established channel rather than creating a public issue with exploit details or credentials. No fictitious email/contact address is supplied.

Supported integration target: Pi 1.0.2 (revalidated from the initial 0.85.1 delivery through 0.87.1 and 0.99.1). Host upgrades require contract, loader, lifecycle and performance revalidation; there is no claim of universal forward compatibility.