ccb reads and writes Cursor context data stored in local SQLite files. Backup archives contain full context as opaque BLOBs — treat them like credentials:

• Encrypt at rest when storing off-machine
• Do not commit archives to git or share casually
• ccb does not redact secrets from stored context

ccb performs no network calls and sends no telemetry. All operations are local.

If you discover a security vulnerability or data-loss bug:

1. Open a GitHub Issue with reproduction steps, or
2. Contact the maintainer via nikitay.com

Please avoid posting backup zips or context excerpts in public issues.

• Prefer closing Cursor before backup/restore when possible
• Use ccb verify before relying on an archive
• Keep pre-restore safety zips until you confirm a restore succeeded

See docs/SAFETY.md for the full safety model.