Security notices explained

These are the notices FEWD Studio shows when a project is about to do something that runs code. They are expected. They are aids to your judgement, not a substitute for it: responsibility for security rests with you, as Security in FEWD Studio explains. Each one is a question, and Not now is always a safe answer: the project stays open and editable.

For the full list of checks behind them, see Security in FEWD Studio.

Trust this folder?

Only trust folders you know. Trusting a folder lets FEWD Studio use its Git settings and run its code to show the preview. Both can run programs on your computer.

When: the first time Git, the preview, an install or a terminal would run in a folder you have not trusted.

What it means: a project’s Git settings and its scripts can run programs. You are being asked whether you know where this folder came from.

What to do: choose Trust this folder for your own projects and ones from people you know. Choose Not now for anything else. You can still edit the project, and you can trust it later from the Git panel.

The question lists the exact command that will run, such as the preview command or the install, so you can read it first.

You downloaded this project from GitHub

You downloaded this project from GitHub, so its Git already works. Only trust folders you know. Trusting it lets FEWD Studio run its code, which can run programs on your computer.

When: you cloned with From GitHub… and are about to start the preview, install, or open a terminal.

What it means: Git was set up by FEWD, but the project’s packages and scripts came from the repository. Running them is a separate decision.

What to do: the same as above. Not now keeps Git working and asks again next time something would run.

This folder can’t be trusted

Your home folder has npm packages or settings (package.json, node_modules). Move them out of your home folder rather than trusting it.

When: the project folder is your home folder or the top of a drive.

What it means: everything below would count as one trusted project, which is too broad. There is no Trust button.

What to do: move the files into a project folder and open that instead.

A folder above this project has npm settings

A folder above this project has npm settings or packages, and it isn’t trusted. Trust it, or move the project.

When: a parent folder holds a package.json, .npmrc or node_modules that npm would use for the project.

What to do: trust the parent if it is yours, or move the project somewhere tidy.

Git is off for this folder

Git is off for this folder until you trust it. Git settings inside a project can run programs on your computer.

When: you answered Not now, or the Git panel opens in an untrusted folder.

What to do: press Trust this folder in the panel when you are ready.

The preview, install or terminal is off

The preview is off for this folder until you trust it. Starting it runs the project’s own code.

Installing this project’s packages is off until you trust the folder. Installing runs the packages’ own code.

Terminals are off for this folder until you trust it. A shell started in a folder can run that folder’s own settings.

What to do: the same as the main trust question. A terminal opened before you trusted a folder keeps Git off; open a new one after trusting.

Before you install packages

Installing npm packages can run code on your computer, and newly published packages carry more risk. A 7-day wait before installing new versions is a commonly recommended precaution…

When: once, the first time FEWD would install packages. It is a consent screen: tick I understand and press Continue. It is asked again only if its wording changes materially.

What to do: read it, and use How to set this up if you want the same 7-day wait for the installs you run yourself.

Install project packages

Only open projects you trust. Installing a project’s packages can run code on your computer.

When: you press Install on a project, or FEWD sets up a new site.

The two options:

• Install without running package scripts (safer) is ticked by default. Untick it only if the project does not run without them.
• Skip the 7-day wait for this install appears for a project without a lockfile. It applies to that one install only.

A project with a lockfile says it will install the exact versions the lockfile lists, however recently they were published. The 7-day wait does not apply, because the lockfile decides every version.

Not installed: newer than 7 days

A version this needs was published less than 7 days ago, so npm did not install it under the 7-day wait. Nothing is wrong with the name or the version.

What it means: the wait did its job. The version is real; it is just new.

What to do: wait a few days, or press Try again with the wait skipped if you need that version now.

Not installed: your npm settings

npm did not install a version because it was published too recently for this computer’s own npm settings.

What it means: the 7-day wait was already skipped, so the limit comes from your own .npmrc or an npm guard on your machine, which FEWD did not set and cannot lift.

What to do: wait, or change that setting yourself.

The lockfile does not match

This project’s package-lock.json does not match its package.json, so the exact versions it lists cannot be installed.

What to do: ask whoever maintains the project to update the lockfile, or install by hand in the terminal if you accept what that does.

Could not check GitHub

When: a project’s own Git settings change how Git reaches GitHub, such as a proxy or custom headers. FEWD does not send your sign-in in that case, and nothing runs.

What to do: check the project’s Git configuration. If you did not expect it, treat the folder with suspicion.

GitHub didn’t accept FEWD Studio’s sign-in

GitHub didn’t accept FEWD Studio’s sign-in for this repository. Sign in again, or check your organisation allows FEWD Studio.

What to do: sign in again from Preferences, or ask an organisation owner to approve FEWD Studio.

An update is available

When: a new version exists. Release notes mark security updates.

What to do: press What’s new, then Update when you are ready. Nothing installs without you.

Unsure about a notice?

Choose Not now, keep editing, and get in touch with the wording you saw.