# Safety model

- **Credentials** live in env vars or the gitignored `.storebound/credentials.json`, never in the config or the repo.
  storebound only talks to the official store APIs (plus Google Fonts, your own Play reports bucket and your own URLs);
  see [SECURITY.md](../SECURITY.md).
- **Dry run everywhere.** Every write command takes `--dry`; every MCP write tool has `dry_run`, **default true**.
  Raw API writes (`storebound api`) are dry unless `--yes` is given in an interactive terminal; owner-only operations
  also need the operation id typed, and MCP only gets the read-only `api_get`.
- **Nothing public or irreversible through an agent.** Submitting for review (App Review and Beta App Review),
  releasing a version, production releases, resuming or completing a rollout or phased release, canceling a
  submission, deleting, inviting or removing testers, sending review replies, applying prices and starting or
  stopping a product page test and creating custom offer codes are not MCP tools. Subscription syncs through MCP only
  create what is new; price changes of live subscriptions wait for a terminal run. They stay terminal commands that ask for confirmation, and the skills tell every agent to ask the owner
  first ([docs/agents-core.md](agents-core.md)).
- **Personal data stays local.** Tester lists, the App Review demo account, reply drafts, health reports and analytics
  snapshots live in the gitignored `.storebound/` (the demo account is masked in every log line); tester emails are masked in every log line, and the config refuses a tester CSV path
  outside `.storebound/`.
- **Idempotent writes.** Re-running a command converges (MD5 checks for screenshots and previews, one Play edit per
  language), so a failed upload is fixed by running it again.
- **Simulators and emulators**: storebound shuts down only a simulator it booted itself and never boots, wipes or
  reboots an Android emulator or device.

---

[All docs](README.md) · [README](../README.md)