Security
The Sume CLI is designed for agent use, but CLI output can still contain sensitive or user-owned data. Treat auth, job, and media output carefully.
Secrets
Never print or commit:
SUME_API_KEY;- local
~/.sume-com/config.json; - raw provider payloads.
Use environment variables or secret managers for automation:
For local development, prefer sume login so the CLI can create and store a
scoped key through the
CLI login approval flow. Manual keys live in
the API Keys dashboard.
Write and paid gates
Current write commands require confirmation flags.
| Gate | Use for |
|---|---|
--confirm-submit | Non-paid writes such as job cancellation. |
--confirm-paid | Provider-backed Avatar 1.0 and Avatar Video 1.0 runs that can reserve or spend credits. Image/Video/Music are API-first today — apply the same confirmation discipline in your HTTP client. |
Agents should confirm user intent, submit one bounded job first when testing, and recover existing jobs instead of blindly retrying paid commands.
Media URLs
Sume job results can include first-party media URLs. They are public URLs but still user data.
When reporting results:
- summarize media counts and file types;
- use local filenames instead of full remote URLs when possible;
- redact query strings and private identifiers;
- avoid dumping large raw result payloads.
Bug reports
Include sanitized command names, error codes, request ids, and job ids when useful. Do not include API keys, signed URLs, full private media URLs, raw provider payloads, emails, or workspace/user ids unless engineering explicitly asks.