Yes, by construction rather than by promise. The core rule: model output never becomes an action. Everything OpenCues writes lands in your unsent draft, where you read it before anyone else does; you are always the one who presses Enter.
The layers on top of that rule
- Sandboxed extensions. Third-party JavaScript blanks run capability-restricted: no filesystem, no process access, hostname-exact network allow-lists, namespaced storage. Scripts are local-or-shipped only; nothing auto-installs from the network.
- Isolated prompts. Each cue source only sees the words it claims and gets its own isolated LLM call, so one bad config file can't steer the rest.
- Personal data stays home. The identity feature defaults to safe mode: providers see tokens like
[EMAIL]; your machine substitutes real values after the response. It works both ways - a stored value you type yourself is swapped for its token before the text is sent. - No telemetry. No OpenCues servers exist; your text goes only to the provider you configured, on your own key.
The honest caveat: the standard is still a draft, and the full threat model is public so you can judge it yourself. Related: the security model in depth · GitHub repo