🔓 Why We Enabled –allow-insecure in the command Tool

Starting from the new version of CPTD CLI, we’ve introduced the --allow-insecure flag in the command utility. This was a deliberate decision made in response to developer needs:

• to test commands in local or sandboxed environments,
• to load temporary or debug ZIP archives that don’t fully comply with validation rules,
• to quickly experiment with non-standard commands without full manifest structure.

🚨 What Does --allow-insecure Do?

The flag allows you to:

• bypass security checks when adding a command, even if:
  • manifest.yaml or manifest.json is missing;
  • the ZIP archive has an unsupported folder layout;
  • the target platform does not match your system;
  • dependencies are nonstandard or entrypoint is not properly declared.

🔐 Why Is It Disabled by Default?

Security and modularity are core values of CPTD CLI. By default, we continue to:

• block suspicious or incompatible command packages;
• validate manifest files and directory structure;
• prevent automatic dependency installation in user code.

But with --allow-insecure, responsibility shifts to the user, as in any extensible toolchain.

✅ When Should You Use It?

• During local development or testing
• When analyzing or importing experimental commands
• To inspect ZIP bundles without being blocked

⛔ When Not to Use It?

• In production environments
• With untrusted third-party commands
• In unattended or automated scripts

---

📌 Reminder: CPTD CLI will always ask for explicit confirmation before performing insecure operations.

CRYPTOPROTOS (CPTD CLI)
https://www.cptdcli.com/
PIP CPTD Version: 2.0.4