Security

Short excerpts do, and they can contain code. To write the steps for each thing you're working on, Shabash sends Anthropic's AI, Claude, your prompts (cut short), the end of each of Claude's replies, chat and commit names, folder and branch names, your pull requests' titles and reviewers, the start of each CLAUDE.md and a linked ticket's text. Code you pasted into a prompt goes with it. Common keys and passwords are removed first.

Your code files, diffs and full chats stay on your Mac.

Only what you allow in setup: the chats of the coding agents you tick (Claude Code, Codex or Cursor), the project folders you choose, the pull requests in the repos you choose, yours and your teammates', and for a team's retro the commits on its repos' main branches, through your own gh login (and your assigned GitHub issues, if you use them for tickets), and Linear or Jira with a key you paste. Each setup step shows exactly what it reads before you press its button.

Through the same gh login, Shabash asks GitHub whether each of those repos is a fork, with gh repo view <repo> --json parent, the first time it reads each repo once you've allowed GitHub. If one is a fork, and you haven't said where its pull requests go (in Setup, or with gh repo set-default), Shabash asks you. <repo> is the GitHub repo of the folder's origin remote, or of upstream when origin isn't on GitHub, or else of its first remote on GitHub. It asks GitHub again only if that choice of remote or its address changes, or you press Refresh.

On the step that asks which coding agents you use, Shabash first checks whether each one is on your Mac, by name only: whether /Applications/Cursor.app or the ~/.cursor folder is there, for example. It opens nothing inside them. The step lists every path it checked and whether it found it, and ticks the agents it found.

Before you press Allow, that step lists every file it will read. For Claude Code that's ~/.claude/history.jsonl and ~/.claude/projects/*/*.jsonl. For Codex: ~/.codex/sessions/*/*/*/rollout-*.jsonl, ~/.codex/archived_sessions/rollout-*.jsonl (and in its dated folders), ~/.codex/history.jsonl and ~/.codex/session_index.jsonl. For Cursor: ~/.cursor/chats/*/*/meta.json and store.db, ~/.cursor/projects/*/agent-transcripts, and in ~/Library/Application Support/Cursor/User the files globalStorage/state.vscdb, workspaceStorage/*/workspace.json and workspaceStorage/*/state.vscdb.

To group your chats by project, Shabash checks by name whether each chat's folder, or a folder above it, has a .git folder, going up until it reaches your home folder, the folder that holds it, the top of the disk, Desktop, Documents, Downloads, iCloud Drive and an external or network drive, none of which it checks. It also checks whether the chat's folder has package.json, CLAUDE.md, README.md, index.html or pyproject.toml, and if it does, whether each folder inside it where other chats ran has a .git folder. It opens none of them.

In the project folders you choose, Shabash runs only a fixed list of git commands, and through your gh only a fixed list of GitHub commands. Setup shows both lists before you allow them.

When two chats work in one project at once, Claude makes a second checkout of it so neither switches branches under the other. Shabash counts the ones that are finished with on the Done tab, and Clean them up asks your own Claude to remove those exact folders. It only counts a folder with nothing uncommitted in it, no chat working in it, and never the folder you chose. Shabash removes no folder, branch or file itself.

Settings → Access → What Shabash read on this Mac lists every folder and file Shabash looked at or read, and every program it ran, with when, why and the setting that allowed it. Export saves the list for your security team.

The Mac app also watches the project folders you choose on this Mac's own disk, so it runs git again only where something changed. It runs git in every folder only when you press Refresh, or when it can't tell what changed. Network and external drives aren't watched. The watcher learns only which folders changed, never what's in your files.

The Mac app watches Shabash's own folder, ~/.shabash, for changes to its files, so the window updates as soon as Claude ticks a step.

Shabash reads Claude Code's settings files, since it adds its hooks there.

When you press Continue and Shabash can't type your task into that chat's terminal yet, because Claude is asking you something or the terminal isn't in front, it waits. Meanwhile macOS tells it each time you switch apps. Each time, it checks whether Claude Code's hooks say the question is answered and whether that chat's terminal is in front. Once both are true, it types the task in, with the macOS Accessibility permission it asks you for before it types anything. 30 minutes after you pressed Continue, it gives up and types nothing.

If you press Look on setup's Claude's rules step, or turn it on in Settings, Shabash reads the instructions Claude reads in each project folder you chose: CLAUDE.md, .claude/CLAUDE.md, AGENTS.md, CLAUDE.local.md and .claude/rules/, and the CLAUDE.md in each folder above one, up to your home folder. From Claude Code's settings files it reads only the allow, ask and deny lists, never env. It shows each rule short, like Bash(curl +4 words), so a key saved inside one never shows. It looks in your Claude history only to tell whether a command you allowed once has run in that repo in the last 30 days.

When Continue opens your work in Cursor or VS Code, Shabash checks that editor's list of extensions for Claude Code. If it's missing, Shabash says so, and installs it only when you press Install.

No. Under Anthropic's commercial terms, API data isn't used for training, and Anthropic deletes it within 30 days by default. Shabash's server passes requests on and keeps none of the text.

In your Mac's Keychain, not in files, protected by your macOS login. That's your Shabash sign-in, your Linear or Jira key, and your Anthropic key if your company uses its own. Shabash never reads your Claude login, or any API key you didn't paste into Shabash.

Shabash removes common keys and passwords before anything is sent. Settings → AI and privacy counts how many it removed.

It adds a few entries to Claude Code's settings so it can follow your sessions, and a status line and the /thread command if you don't have them. If you tick Codex or Cursor, it adds the same kind of entries to their settings, and the same commands. In Codex they are skills in ~/.agents/skills, a folder Cursor and other agents also read. Codex and Cursor run each one only when you type it. You see each entry before you add it, and each settings file is backed up first. It adds no rules for commands or git. On Claude's rules, Apply takes out only the rules it shows as leftovers: one another rule in the same file already allows, or one exact command that hasn't run in that repo in 30 days. It changes nothing else in the file, keeps a backup only you can read, and Undo puts them back. It holds back a few commands, and nothing in your settings changes: merging a pull request before its checks on GitHub pass or before every step of its work is ticked, or when you chose in Settings to do that merge yourself; a commit on a branch that belongs to another piece of work than the one Claude is on; and a pull request opened without the line that tells Shabash which work it belongs to. Each time, Claude is told why and what to do instead.

Nothing until you join a team with its invite link. After that, only what you share: a thread's title, outcome and your note when you press Share, and your open pull requests when you press Share my open PRs. Your team sees the name you typed when you joined.

If you keep your work on this Mac, with your own Anthropic key, teams stay off until your company gets Shabash for your team.

On any day, anyone in the team can press Make on the Retro page to write up what's changed since the team's last update. Claude gets the titles of the pull requests merged since then and the commits made straight to your shared repos' main branch, and the update is kept for the team to read. A team gets at most one a day.

Crash reports are off until you say yes. A crash report says what went wrong in Shabash's own code, with your Shabash and macOS versions. It never holds your prompts, your code, your project names or paths from your Mac.

Report a problem sends the words you type, with keys and tokens cut out first, and you see the whole report before you press Send. It's saved with your account's email so we can reply.

Both go only to Shabash's server and are deleted 30 days after they arrive. Settings → Access lists every report that left your Mac, word for word, and turns crash reports off.

Settings → Access lets you turn off or disconnect each thing Shabash reads, and remove everything Shabash added to Claude Code. Signed out, Shabash's AI sends nothing.

Wonders AI, Inc. Sign-up is by invite only. Questions go to hello@shabash.dev.

Your email, plan, sign-in dates and invite, how much AI you used each month, and for 30 days the problems you report. If you're in a team, what you shared with it and its updates. Never your prompts, Claude's replies or your code in a form it can read. If you connect Claude Code cloud sessions, their steps and the first words of their prompts pass through it sealed with a key only your Mac has, and each is deleted once your Mac takes it.

Email hello@shabash.dev and we'll delete your account and send the steps to remove Shabash's files from your Mac. Settings → Access removes everything Shabash added to Claude Code.