SENTINEL

0 / 120%

Write ~/.grok/config.toml with the hard vetodisable_codebase_upload = true under [harness]. This is the local kill switch.
Set telemetry environment variablesGROK_TELEMETRY_TRACE_UPLOAD=false and GROK_TELEMETRY_ENABLED=false.
Check logs for repo_state.uploadIf you see repo_state.upload.start, treat the repository as having left the machine.
Rotate secrets from any Build workspaceAPI keys, database passwords, cloud creds, OAuth tokens, SSH keys, JWT secrets.
Stop Grok processes and drain the upload queuepkill, then rm -rf ~/.grok/upload_queue/*.
Stop sharing sensitive chatsShare is publication. Use screenshots if you must show a conversation.

Revoke existing shared linksVisit grok.com/share-links and unshare everything you do not intend to be public.
Search indexes for your own phrasesIncognito, site:grok.com plus a unique line from a past chat. Request Google removal if you find hits.
Do not summarize untrusted pages in a logged-in GrokCCI rides “summarize this page.” Treat unknown URLs as hostile.
Run verify.sh after every Grok updateAuto-updates can restore harvest. Fail-closed on inconclusive.

Add a .grokignore to every repoExclude env files, keys, and anything named secret or password.
Run Build only in isolated workspacesNo real credentials. Prefer a container or VM with outbound monitoring.