Safety

Caution

Buttons runs the commands exactly as they are written.

Review a shared project’s .buttons.json before running its commands. Treat it like a Makefile or a package.json script. Commands are not sandboxed. Running a button has the same effect as typing that command into a terminal yourself.

Your ~/.buttons.json is personal and is never shared with a project. Keep credentials or environment-specific commands out of a project’s .buttons.json if that file will be committed.

A few things worth knowing:

• Buttons reads scripts from files and stores references to them. It never modifies your package.json, Cargo.toml, go.mod, Makefile, composer.json, or justfile.
• Custom commands are stored verbatim and are never rewritten by scanning.
• A script button’s command is recomputed when the underlying script or package manager changes, so it always reflects the current source of truth.