Credentials

OAuth tokens are stored encrypted, never in plain text. Token exchange for most connectors happens on PawOS’s backend, so a client secret is never present on your machine at all.

How it works

What you see

• Permission questions, connection approval screens, blocked-action messages, workspace boundaries and system-change warnings.
• When something is blocked, you see why.

What PawOS does

• Security-sensitive actions are carried out by protected parts of the app that the interface cannot bypass.
• Commands follow strict rules that prevent injected or chained commands.
• Credentials stay in each connection’s secure storage — you never paste them into chat.

Permissions

• No plan approval, companion setting or urgency can skip a permission question.
• Changes to files, commands, git, installs, system settings, deployments and connected services always need approval.

Records

• Security-sensitive actions record the request, the approval, the result, and why anything was blocked.

Good to know

• Review plans, diffs, commands and deployments before approving them.
• Your operating system and connected services have their own permission prompts and policies.