Agent Risk & Acceptable Use

SHIPIT runs AI coding agents on your Mac. That is useful and it is risky. This document says, in plain words, what agents can do, what can go wrong, what you are responsible for, and what you may not use SHIPIT for.

It is part of the SHIPIT Terms of Use. If the two ever disagree, the Terms of Use win. "We" and "Dzhura" mean Maksym Zhuk, who makes SHIPIT. "You" means the person using SHIPIT.

The short version

• Agents act on your Mac, as you, with your accounts. They can change or delete files, run commands, push code and publish.
• Ask before acting is the default for new installs: agents ask for your approval before they run commands and, for most agents, before they edit files. Full access removes those stops. You turn it on and confirm it yourself.
• Agents make mistakes and can be tricked by text they read. Keep backups, use git, and review changes before you push or deploy.
• You use SHIPIT and the agents it runs at your own risk. You are responsible for what you approve and for what agents do in Full access. Our liability is limited as the Terms of Use describe, and rights the law gives you are not affected.
• Don't use SHIPIT for malware, break-ins, spam, illegal content or sanctions evasion. If you do, we end your access.

01What agents can do on your Mac

The agents are not ours. SHIPIT runs third-party AI coding tools, such as Claude Code, Codex, Grok, Gemini, OpenCode, Cursor and Aider. Other companies and projects make them, and they run under your own accounts and plans. SHIPIT is not made by, or affiliated with, those companies.

Where they run. In Code, each agent runs in a terminal pane. In Chat and Agent, SHIPIT runs them in the background, without a terminal window.

What they can reach. Agents run as your macOS user. Roughly, anything you can do in Terminal, they can do:

• read, create, change and delete files your user can access;
• run programs and scripts, and install packages;
• use the internet;
• use command-line tools you are signed in to, such as git, gh (GitHub), hosting and cloud tools, and your SSH keys.

If you give SHIPIT Full Disk Access (setup offers it, so macOS stops asking about every folder), the agents SHIPIT starts get that access too. They can then read files macOS normally protects, such as Mail and Messages data. If you turn on the Personal plugin, agents can also read your contacts, calendars and reminders and, with your approval, send iMessages.

What SHIPIT itself does for you.

• New Project creates a folder and a git repository and, if you leave the switch on, a private GitHub repository through your own gh sign-in, and pushes the first commit.
• Deploy uploads your project to your own hosting account and makes the site public. With Production on, it replaces your live site. SHIPIT deploys only when you press Deploy.

What SHIPIT does not do. Apart from the approval cards in the Agent tab, SHIPIT does not watch, filter or record what your agents do, and we do not receive your prompts or code. That also means we cannot stop an agent for you or undo what it did. What you ask an agent, and the files it reads, go to that agent's provider (Anthropic for Claude Code, OpenAI for Codex, xAI for Grok, Google for Gemini, and whichever provider you set up in tools such as OpenCode or Aider). Their terms and privacy policies apply. Our own handling of data is in the Privacy Policy.

02The two modes

Choose in setup or in Settings › Agents & AI.

Things worth knowing:

• Ask before acting is only as safe as your review. When you approve a command, it runs with your permissions. Read what you approve. Choices like "always allow" in an agent widen what it can do without asking.
• Approvals in Code panes come from each agent's own permission system. How and when an agent asks is decided by that agent and can change when it is updated. SHIPIT cannot promise that every tool asks before every risky step.
• The mode covers agents SHIPIT starts: in Code, Agent and Chat. An agent you start yourself by typing claude or codex in a terminal follows that tool's own settings.
• If you used SHIPIT before version 1.0, it kept Full access so nothing changed under you, and it asks you to keep Full access or switch to Ask before acting. You can switch at any time.
• Switching modes applies to agents started after the switch. An agent that is already running keeps its old mode until you restart it.

03What can go wrong

These are real failure modes of today's AI agents, not hypotheticals.

Deleted or overwritten data. An agent "cleans up" a folder, rewrites a file from scratch, or overwrites your uncommitted work. Files outside git, and changes you never committed, may be gone for good.

Destructive commands. rm -rf, git reset --hard, git push --force, dropping a database, deleting cloud resources, killing processes, changing system settings. One line can do a lot of damage, and an agent can type it faster than you can read it.

Secrets sent to model providers. Agents read files to understand your project. If a .env file, an API key, a password or customer data sits in a file or in terminal output, it can end up in the prompt sent to the provider. Agents can also commit secrets to git, push them to GitHub, or include them in a deploy.

Costs on your accounts. Agents spend your plan limits or, with API keys, real money per use. Several agents in parallel spend faster. Agents can also create paid resources on hosting or cloud accounts you are signed in to. These charges are between you and those providers.

Private code pushed or published. New repositories SHIPIT creates are private, but an agent with your GitHub sign-in can make a repository public, create a public one, post a gist or publish a package. A deployed site is public. With Production on, a deploy replaces your live site.

Prompt injection. Agents follow instructions, including instructions hidden in text they read: a web page, a README, an issue or pull request comment, a dependency, the output of a command. A cloned repository can contain text written to make an agent leak your secrets or run a harmful command. Installing packages also runs other people's code. Ask before acting helps only if you read what you approve.

Breaking someone else's terms. Your agent providers, GitHub and your hosting each have rules: for example on automated or unattended use of a personal plan, on sharing an account, on rate limits, or on scraping. Running agents through SHIPIT does not change those rules, and a breach can get your accounts limited or closed.

Legal and licensing problems in what agents make. Generated code can closely match code under someone else's license. Dependencies agents add carry their own licenses. Who owns AI-generated work is unsettled in some countries. Generated text and images can infringe rights. If what you build handles personal data, privacy law applies to you.

Mistakes that look correct. Agents say "done" when they are not. Tests can pass because an agent weakened or deleted them. Code can call functions that do not exist, or open a security hole while looking tidy. Confident wording is not evidence.

04Your responsibilities and safeguards

You are responsible for what you approve, for what agents do in Full access, and for what you publish. These habits keep most problems small:

• Keep backups. Time Machine is enough for most people. Git does not cover uncommitted work or files outside the repository.
• Use git. Commit before you hand off a task, work on a branch, and read the diff afterwards. Then "undo" is one command away.
• Review before you push or deploy. Read the changes, run the app, and use a preview deploy before Production.
• Keep Ask before acting for anything unfamiliar: a repository you just cloned, code from strangers, tasks that browse the web or read issues.
• Use least privilege. Give agents only the accounts and tokens they need: fine-grained GitHub tokens limited to the right repositories, no admin cloud credentials on the same Mac user, spending limits on provider and hosting accounts. For risky work, consider a separate macOS user.
• Don't paste secrets into prompts. Keep .env and key files out of git and out of deploys; use your hosting's environment variable settings. If a secret leaks, rotate it right away.
• Grant Full Disk Access only if you need it, knowing the agents SHIPIT starts inherit it.
• Stay in the loop. Watch what agents do and stop one that goes off track.
• Follow your providers' terms and policies.

05Acceptable use

You may not use SHIPIT, or have agents use it, to:

• create, spread or deploy malware, ransomware, spyware, credential stealers or any code meant to damage, disable or secretly control systems;
• get into systems, accounts or data you are not allowed to access, or scan, probe or attack networks and services you don't own or have written permission to test;
• send spam, run fake accounts or bot networks, post fake reviews, or scrape sites against their terms or rate limits;
• create or share illegal content, including child sexual abuse material, fraud, phishing, harassment, or content that infringes others' rights;
• collect or process personal data unlawfully, or surveil people without a lawful basis;
• evade sanctions or export controls, or work for or on behalf of sanctioned people, organizations or regions;
• get around a provider's safety measures, usage limits or account rules, or resell or share access you are not allowed to share;
• tamper with SHIPIT's code signing, update service or our servers.

Security work is fine on your own systems, and on others' with their written permission and within the law.

You must also follow the usage policies of every service your agents use: Anthropic, OpenAI, xAI, Google, GitHub, your hosting, and any other.

What happens if you break these rules. We may suspend or end your Dzhura account and your access to paid services, as section 18 of the Terms of Use describes. Refunds follow the Terms of Use. Where the law requires, we report to the authorities. We do not monitor your work, so we act on reports and evidence.

06Our responsibility, and its limits

We build SHIPIT with care: Ask before acting for new installs, a confirmation before Full access, private repositories, deploy only on your click. But we cannot control models that other companies run, or what an agent does with the access you give it.

You decide what agents may do. You are responsible for what you approve and for what agents do in Full access. Within the limits the law allows, we are not liable for loss caused by agents' actions, such as lost or damaged data, leaked secrets, charges on your accounts, or code or sites published. This does not apply when the loss was caused by SHIPIT itself not working as described, for example if SHIPIT starts an agent in Full access when you chose Ask before acting. The full rules, including the limits of our liability, are in the Terms of Use. Nothing here limits liability that the law does not allow us to limit, or your statutory rights as a consumer.

07Report a problem or abuse

• A bug in SHIPIT: Help › Report a Problem… in the app, or [email protected].
• A security vulnerability in SHIPIT: write to [email protected] with "Security" in the subject. Describe the steps and the SHIPIT version. Please give us time to fix it before you publish details.
• Someone is using SHIPIT against you or your systems: write to [email protected] with "Abuse" in the subject, and say what happened, when, and any logs or addresses you have. We cannot see users' work, so your details are what we act on.
• An agent did something harmful on your Mac: stop the agent, rotate any secret it could have read, check your git history and accounts, restore from a backup if needed, and tell us at [email protected]. If the model itself behaved badly, report it to its provider too.

Changes to this document

We may update this document as SHIPIT and the agents change. Each version has a number and a date at the top, and earlier versions stay available on dzhura.app. When it changes, SHIPIT shows a notice you can review without being blocked from your work. Changes take effect for you as section 21 of the Terms of Use describes.