Security FAQ

What does the install script actually do?

The install script (install.sh) does three things:

1. Downloads a pre-compiled binary for your OS/arch from term.works/bin/
2. Places it in ~/.termworks/bin/
3. Appends a single line to your ~/.zshrc or ~/.bashrc that registers a shell hook

The script source is readable at term.works/install.sh. You can inspect it before piping to bash.

What does the shell hook actually do?

The shell hook fires after each command completes. It passes the command name (the first token only — e.g. cargo from cargo build --release) to the TermWorks binary, which maps it to a broad category like "rust".

The binary then decides whether to display an opportunity based on your category preferences, timing rules (it won't show anything more than once every few minutes), and the active campaign pool. No subprocess output, no environment, no arguments are read.

Can it see my commands, arguments, or secrets?

No. The hook passes only the command name — the first word — to the binary. Arguments, flags, environment variables, file paths, and stdout/stderr are never read by TermWorks.

The binary does not read your shell environment. It reads only its own config file at ~/.termworks/config.json, which contains your preferences and install ID.

What data is sent to your servers?

When an opportunity is displayed, the binary sends:

• Command category — a broad label like "rust" or "kubernetes"
• Exit status — whether the previous command succeeded (0 or non-zero)
• Install ID — a random UUID generated at install time, not tied to your identity
• Timestamp and session timing — when the event occurred

That's it. No hostname, no username, no IP geolocation beyond what any HTTPS request reveals, no raw commands, no file paths.

Can I see the source code?

The CLI is written in Go. The shell hook itself is a short function — you can read the exact code appended to your RC file by running termworks doctor after install.

Will it slow down my terminal?

The binary is a ~5ms native binary. On the vast majority of commands it exits immediately without displaying anything. When it does display an opportunity, it makes a single async network call in the background — your prompt returns first.

If you're on a machine where even 5ms matters (tight CI scripts, etc.), you can disable it with termworks disable. No data is sent while disabled.

How do I disable or uninstall?

• termworks disable — pauses all hooks and network calls. Re-enable with termworks enable.
• termworks uninstall — removes the binary and cleans the hook from your RC file completely.

Both commands are local — they don't require network access or an account.

Does it show sponsors inside Claude Code, and how do I turn that off?

If you use Claude Code, TermWorks shows a single targeted sponsor in its status line and rotates the “thinking” spinner verbs. These surfaces are on by default, and they reuse the exact same targeting, timing, and privacy rules as the shell hook. The status-line input Claude Code pipes in — your repo, working directory, model, cost, and session — is read locally and never transmitted; only the same broad category/exit/timing fields described above are ever sent.

Turn them off anytime with termworks claude off. The choice is sticky — it survives syncs, updates, and reinstalls — and you can turn them back on with termworks claude on. Premium accounts never see sponsors at all.

Do you sell my data?

No. Advertisers buy impressions (showing their ad in a relevant context) — they never receive individual user data, install IDs, or anything that could identify you. They see aggregate campaign stats only: impressions, clicks, spend.

We don't share data with third parties beyond our infrastructure providers (Supabase for the database, Stripe for payouts, Vercel for hosting). See the full privacy policy for details.

How do you stop scam or malware ads from showing up?

Every campaign is reviewed by a person before it can serve a single impression. Ads are submitted in a pending state and stay dark until we approve them — there's no self-serve path that skips review, and paying for a campaign never launches it automatically.

We reject anything misleading, anything pointing at a sketchy landing page, and anything in a prohibited category — adult, gambling, malware, crypto schemes, or anything illegal (see the terms). It's a curated pool, not an open marketplace: “anyone can advertise anything” is exactly what TermWorks is not.

If something ever slips through, we can pause an individual campaign or kill all ad serving platform-wide instantly. And because targeting is opt-in and coarse — your category preferences, never behavioral profiling — nobody can quietly buy their way in front of you. Premium accounts see no sponsors at all.

Why should I trust a curl | bash install?

Fair concern. You don't have to use curl | bash. Alternatives:

1. Download and inspect the install script first: curl -fsSL https://term.works/install.sh > install.sh && cat install.sh
2. Download the binary directly from term.works/bin/ and install it manually
3. Build from source — the repo includes a Makefile with make build