# Security

## Security
The configuration file holds your [Customer Portal](/client-spec/customer-portal) credentials in plaintext on disk. Treat it like an SSH private key:
- **Don't commit** the config to a shared repository if it contains real credentials.
- **Use user-scope** (per-machine config) rather than project-scope when running with prod credentials.
- **Rotate credentials** if your laptop is lost or shared with a team member.
- **Limit blast radius** — every tool call runs under the authenticated customer; there's no read-only mode at the credential level. Tell the AI to *"only read, don't make changes"* when you want to explore safely.

If you don't want prod credentials on your machine, omit the `SCOREAPI_PROD_*` env vars and only configure dev. The MCP works fine with one environment.

Version: v3

## Description:

  - `Security` ()
    The configuration file holds your Customer Portal credentials in plaintext on disk. Treat it like an SSH private key: Don't commit the config to a shared repository if it contains real credentials.Use user-scope (per-machine config) rather than project-scope when running with prod credentials.Rotate credentials if your laptop is lost or shared with a team member.Limit blast radius — every tool call runs under the authenticated customer; there's no read-only mode at the credential level. Tell the AI to "only read, don't make changes" when you want to explore safely. If you don't want prod credentials on your machine, omit the SCOREAPI_PROD_* env vars and only configure dev. The MCP works fine with one environment.