TL;DR: CLIFlow runs 100% offline, collects zero data, requires no accounts, and can be installed as a standalone binary with no runtime dependencies.

┌─────────────────────────────────────────────────────────────────────┐
│                        CLIFlow Security Model                        │
├─────────────────────────────────────────────────────────────────────┤
│                                                                      │
│   ┌──────────────┐    Unix Socket    ┌──────────────┐               │
│   │   Terminal   │◄─────────────────►│    Daemon    │               │
│   │   (User)     │   Local IPC Only  │  (Local)     │               │
│   └──────────────┘                   └──────────────┘               │
│                                             │                        │
│                                             ▼                        │
│                                    ┌──────────────┐                  │
│                                    │  Completion  │                  │
│                                    │    Specs     │                  │
│                                    │   (Local)    │                  │
│                                    └──────────────┘                  │
│                                                                      │
│   ❌ No Internet Connection                                          │
│   ❌ No Cloud Services                                               │
│   ❌ No External APIs                                                │
│   ❌ No Telemetry/Analytics                                          │
│                                                                      │
└─────────────────────────────────────────────────────────────────────┘

~/.cliflow/
├── cliflow.sock      # Unix socket for local IPC
├── daemon.log        # Daemon logs (local only)
├── daemon.pid        # Daemon process ID
└── specs/            # User's custom completion specs
    └── *.mjs

No access to:

• User documents
• Browser data
• Credentials/keychains
• Other applications

No npm, no Node.js runtime required.

# Download
curl -fsSL https://github.com/adnankoroth/cliflow/releases/latest/download/cliflow-macos-arm64.tar.gz -o cliflow.tar.gz

# Verify SHA256 checksum (IMPORTANT)
shasum -a 256 cliflow.tar.gz
# Compare output with checksum on GitHub Releases page

# Install
tar -xzf cliflow.tar.gz
sudo mv cliflow /usr/local/bin/

Why this is secure:

• Single binary, no external dependencies at runtime
• Verifiable with SHA256 checksum
• No npm install = no supply chain risk
• No node_modules = smaller attack surface

brew install adnankoroth/cliflow/cliflow

Security: Homebrew formulas are public and auditable.

git clone https://github.com/adnankoroth/cliflow.git
cd cliflow
npm ci --ignore-scripts  # Ignore install scripts
npm audit                # Check for vulnerabilities
npm run build
npm run build:standalone # Create binary

Zero — the standalone binary has no runtime dependencies.

All dependencies are well-maintained packages from the npm ecosystem.

# Check for known vulnerabilities
npm audit

# Check for outdated packages
npm outdated

# View dependency tree
npm ls --all

You can verify CLIFlow makes no network connections:

# Monitor network activity (run while using cliflow)
sudo lsof -i -P | grep cliflow
# Expected output: (empty - no network connections)

# Or use Little Snitch / LuLu to monitor

# Monitor with ss
ss -tunap | grep cliflow
# Expected output: (empty)

# Or use nethogs
sudo nethogs

• Source Code Review: Code is open source at github.com/adnankoroth/cliflow
• Dependency Audit: Run npm audit — no high/critical vulnerabilities
• Binary Distribution: Use standalone binary (no npm runtime)
• Checksum Verification: SHA256 provided for all releases
• Network Audit: Verified zero network connections
• Permission Review: Only accesses ~/.cliflow/ and shell configs
• License Review: MIT License — permissive, no restrictions

1. Download standalone binary from GitHub Releases
2. Verify SHA256 checksum
3. (Optional) Sign with corporate certificate
4. Package as .pkg or deploy binary directly
5. Run cliflow setup as post-install script

Do NOT open public GitHub issues for security vulnerabilities.

Email: security@cliflow.dev (or your actual email)

We will:

1. Acknowledge within 48 hours
2. Investigate and fix
3. Release patched version
4. Credit reporter (if desired)

None currently known.

Check GitHub Security Advisories for updates.

Q: Can my company safely allow CLIFlow?
A: Yes. It runs offline, collects no data, and is open source. Install the standalone binary for zero npm dependencies.

Q: Does CLIFlow see my commands?
A: Only when you press TAB for completions. It does not log or transmit your commands.

Q: Can CLIFlow access my credentials?
A: No. It has no access to keychains, credential stores, or environment variables beyond what's needed for shell context.

Q: Is it safe behind a corporate firewall?
A: Yes. CLIFlow makes zero network requests, so firewalls have no effect.

Q: Who maintains CLIFlow?
A: [Your name/org]. The code is MIT licensed and open for community contributions.

MIT License — use freely in personal and commercial environments.

MIT License

Copyright (c) 2024 CLIFlow Contributors

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files...

See LICENSE for full text.