Security and privacy
Read this before you point an agent at something that matters.
Trust
Arbitr runs agents with the same permissions you have. An agent can reach any file or credential you can access, because you set the project folder and that’s where it starts.
Agents run without asking
Agents act on every instruction immediately. No approval prompt appears, and there is no setting to turn them on. This is what lets several agents work in parallel without you refereeing each one. It also means an agent’s mistake lands on disk before you can see it.
Your protection: the work is uncommitted. Review with the Git panel and discard what you don’t want. See Reviewing changes.
Prompt injection
Anything an agent reads can try to instruct it: a source file, a README, a code comment, a dependency, the output of a build. Treat running an agent over a repository you do not trust as running that repository’s code.
What leaves your Mac
Arbitr sends your prompts and your files nowhere. It has no server for them and no API key for any agent. Prompts, replies and transcripts stay on your machine.
The agents themselves talk to their vendors directly, exactly as they do from your terminal. What Claude Code, Codex and Cursor transmit is between you and those vendors, under their terms, not Arbitr’s.
Arbitr itself makes these connections:
| Connection | When |
|---|---|
| The Arbitr release feed and download | Checking or installing an update |
| GitHub, Linear | Only if you add those integrations, with your own token |
| Your provider’s usage endpoint | Only if you add a usage-limits widget |
The update check is an anonymous request for a fixed URL. It sends no identifier, no version, and nothing about you or your projects. Turn it off in Settings → General.
No analytics
Arbitr contains no analytics, no telemetry and no crash reporting. There is no opt-out setting because there is nothing to opt out of.
Permissions Arbitr asks for
One: notifications, so it can tell you a prompt finished while you were in another app. It is requested the first time that happens rather than at launch.
Where things are stored
Everything stays on your machine. Your projects, conversations, prompts, replies and tool calls are stored locally. Settings and preferences are stored locally. GitHub and Linear tokens are stored in your login keychain.
Reasonable practice
- Run agents on repositories whose contents you trust.
- Keep one agent per folder, so you can tell whose change is whose.
- Read the Git panel before you commit. Nothing an agent wrote is committed for you.
- Give the agent CLIs credentials scoped to what the work needs.