diff --git a/CRITICAL_FIXES.md b/CRITICAL_FIXES.md
new file mode 100644
index 000000000..98d8563b8
--- /dev/null
+++ b/CRITICAL_FIXES.md
@@ -0,0 +1,348 @@
+# 🔧 Correções Críticas - Exemplos de Código
+
+Este documento fornece exemplos de código para implementar as correções críticas identificadas no plano de melhorias.
+
+## 1. Correção da Configuração do PostHog
+
+### Arquivo: `src/main.tsx`
+
+**Problema atual (linha 23):**
+```tsx
+defaults: '2025-05-24',
+```
+
+**Correção:**
+```tsx
+// src/main.tsx
+ReactDOM.createRoot(document.getElementById("root") as HTMLElement).render(
+  <React.StrictMode>
+    <PostHogProvider
+      apiKey={import.meta.env.VITE_PUBLIC_POSTHOG_KEY}
+      options={{
+        api_host: import.meta.env.VITE_PUBLIC_POSTHOG_HOST,
+        enabled: false, // Desabilitado por padrão até consentimento
+        capture_exceptions: true,
+        debug: import.meta.env.MODE === "development",
+      }}
+    >
+      <ErrorBoundary>
+        <AnalyticsErrorBoundary>
+          <App />
+        </AnalyticsErrorBoundary>
+      </ErrorBoundary>
+    </PostHogProvider>
+  </React.StrictMode>,
+);
+```
+
+## 2. Analytics com Consentimento
+
+### Arquivo: `src/lib/analytics/index.ts`
+
+**Adicionar verificação de consentimento:**
+```typescript
+export class Analytics {
+  private hasUserConsent: boolean = false;
+
+  async initialize() {
+    // Verificar consentimento salvo
+    const settings = await this.loadSettings();
+    this.hasUserConsent = settings?.hasConsented || false;
+    
+    if (!this.hasUserConsent) {
+      // Não inicializar analytics até consentimento
+      return;
+    }
+    
+    // Inicializar apenas após consentimento
+    this.initializePostHog();
+  }
+
+  async enable() {
+    this.hasUserConsent = true;
+    await this.saveSettings({ hasConsented: true });
+    this.initializePostHog();
+  }
+
+  async disable() {
+    this.hasUserConsent = false;
+    await this.saveSettings({ hasConsented: false });
+    posthog.opt_out_capturing();
+  }
+}
+```
+
+## 3. Restrição de Permissões do Sistema de Arquivos
+
+### Arquivo: `src-tauri/tauri.conf.json`
+
+**Configuração atual (muito permissiva):**
+```json
+"fs": {
+  "scope": ["$HOME/**"]
+}
+```
+
+**Configuração recomendada:**
+```json
+"fs": {
+  "scope": [
+    "$HOME/.claude/**",
+    "$HOME/.claudia/**",
+    "$DOCUMENT/**",
+    "$DESKTOP/**"
+  ],
+  "allow": [
+    "readFile",
+    "writeFile",
+    "readDir",
+    "exists"
+  ],
+  "deny": [
+    "$HOME/.ssh/**",
+    "$HOME/.gnupg/**",
+    "$HOME/.aws/**",
+    "$HOME/.config/gcloud/**"
+  ]
+}
+```
+
+## 4. Remover Flag Perigosa
+
+### Arquivo: `src-tauri/src/commands/claude.rs`
+
+**Código atual (linha 839):**
+```rust
+"--dangerously-skip-permissions".to_string(),
+```
+
+**Correção com confirmação do usuário:**
+```rust
+// Adicionar função para pedir confirmação
+async fn request_user_permission(
+    app: &AppHandle,
+    operation: &str,
+) -> Result<bool, String> {
+    use tauri::api::dialog::{MessageDialogBuilder, MessageDialogKind};
+    
+    let result = MessageDialogBuilder::new(
+        "Permissão Necessária",
+        &format!("Claude Code precisa executar: {}\n\nDeseja permitir?", operation)
+    )
+    .kind(MessageDialogKind::Warning)
+    .buttons(tauri::api::dialog::MessageDialogButtons::OkCancel)
+    .show(|result| result);
+    
+    Ok(result)
+}
+
+// Modificar execute_claude_code
+pub async fn execute_claude_code(
+    app: AppHandle,
+    project_path: String,
+    prompt: String,
+    model: String,
+) -> Result<(), String> {
+    // Pedir permissão ao usuário
+    if !request_user_permission(&app, &format!("Executar Claude em {}", project_path)).await? {
+        return Err("Operação cancelada pelo usuário".to_string());
+    }
+    
+    let claude_path = find_claude_binary(&app)?;
+    
+    let args = vec![
+        "-p".to_string(),
+        prompt.clone(),
+        "--model".to_string(),
+        model.clone(),
+        "--output-format".to_string(),
+        "stream-json".to_string(),
+        "--verbose".to_string(),
+        // Removido: "--dangerously-skip-permissions"
+    ];
+    
+    // ... resto do código
+}
+```
+
+## 5. Melhorar Content Security Policy
+
+### Arquivo: `src-tauri/tauri.conf.json`
+
+**CSP atual (insegura):**
+```json
+"csp": "default-src 'self'; ... script-src 'self' 'unsafe-eval' ..."
+```
+
+**CSP recomendada:**
+```json
+"csp": {
+  "default-src": ["'self'"],
+  "img-src": ["'self'", "asset:", "https://asset.localhost", "blob:", "data:"],
+  "style-src": ["'self'", "'nonce-{NONCE}'"],
+  "script-src": ["'self'", "'nonce-{NONCE}'", "https://app.posthog.com"],
+  "connect-src": [
+    "'self'",
+    "ipc:",
+    "https://ipc.localhost",
+    "https://app.posthog.com",
+    "https://*.posthog.com"
+  ],
+  "font-src": ["'self'"],
+  "media-src": ["'self'"]
+}
+```
+
+**Adicionar geração de nonce no backend:**
+```rust
+// src-tauri/src/main.rs
+use base64::{engine::general_purpose, Engine};
+use rand::Rng;
+
+fn generate_csp_nonce() -> String {
+    let random_bytes: [u8; 16] = rand::thread_rng().gen();
+    general_purpose::STANDARD.encode(random_bytes)
+}
+
+// Injetar nonce no HTML
+fn inject_nonce_to_html(html: &str, nonce: &str) -> String {
+    html.replace("{NONCE}", nonce)
+}
+```
+
+## 6. Melhorar ErrorBoundary
+
+### Arquivo: `src/components/ErrorBoundary.tsx`
+
+**Adicionar captura de stack trace completo:**
+```tsx
+interface ErrorInfo {
+  componentStack: string;
+  digest?: string;
+}
+
+export class ErrorBoundary extends Component<ErrorBoundaryProps, ErrorBoundaryState> {
+  componentDidCatch(error: Error, errorInfo: ErrorInfo) {
+    // Capturar informações detalhadas
+    const errorDetails = {
+      message: error.message,
+      stack: error.stack,
+      componentStack: errorInfo.componentStack,
+      digest: errorInfo.digest,
+      timestamp: new Date().toISOString(),
+      userAgent: navigator.userAgent,
+      url: window.location.href,
+    };
+    
+    // Log detalhado
+    console.error("Error caught by boundary:", errorDetails);
+    
+    // Enviar para sistema de monitoramento (se consentido)
+    if (analytics.hasConsent()) {
+      analytics.trackError(errorDetails);
+    }
+    
+    // Salvar localmente para debugging
+    this.saveErrorToLocalStorage(errorDetails);
+  }
+  
+  private saveErrorToLocalStorage(error: any) {
+    try {
+      const errors = JSON.parse(localStorage.getItem('claudia_errors') || '[]');
+      errors.push(error);
+      // Manter apenas últimos 10 erros
+      if (errors.length > 10) errors.shift();
+      localStorage.setItem('claudia_errors', JSON.stringify(errors));
+    } catch (e) {
+      console.error('Failed to save error:', e);
+    }
+  }
+}
+```
+
+## 7. Validação de Input
+
+### Exemplo de validação para comandos
+
+```typescript
+// src/lib/validation.ts
+import { z } from 'zod';
+
+// Schema para validar caminhos de arquivo
+const FilePathSchema = z.string()
+  .min(1, "Path cannot be empty")
+  .refine((path) => !path.includes('..'), "Path traversal not allowed")
+  .refine((path) => !path.includes('\0'), "Null bytes not allowed");
+
+// Schema para comandos
+const CommandSchema = z.object({
+  projectPath: FilePathSchema,
+  prompt: z.string().max(10000, "Prompt too long"),
+  model: z.enum(['claude-3-opus', 'claude-3-sonnet', 'claude-3-haiku']),
+});
+
+// Função de validação
+export function validateCommand(data: unknown) {
+  try {
+    return CommandSchema.parse(data);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      throw new Error(`Validation error: ${error.errors.map(e => e.message).join(', ')}`);
+    }
+    throw error;
+  }
+}
+```
+
+## 8. Rate Limiting
+
+### Implementar rate limiting básico
+
+```rust
+// src-tauri/src/rate_limit.rs
+use std::collections::HashMap;
+use std::sync::Mutex;
+use std::time::{Duration, Instant};
+
+pub struct RateLimiter {
+    requests: Mutex<HashMap<String, Vec<Instant>>>,
+    max_requests: usize,
+    window: Duration,
+}
+
+impl RateLimiter {
+    pub fn new(max_requests: usize, window: Duration) -> Self {
+        Self {
+            requests: Mutex::new(HashMap::new()),
+            max_requests,
+            window,
+        }
+    }
+    
+    pub fn check_rate_limit(&self, key: &str) -> Result<(), String> {
+        let mut requests = self.requests.lock().unwrap();
+        let now = Instant::now();
+        
+        let user_requests = requests.entry(key.to_string()).or_insert_with(Vec::new);
+        
+        // Remove requisições antigas
+        user_requests.retain(|&instant| now.duration_since(instant) < self.window);
+        
+        if user_requests.len() >= self.max_requests {
+            return Err("Rate limit exceeded".to_string());
+        }
+        
+        user_requests.push(now);
+        Ok(())
+    }
+}
+```
+
+## Implementação Prioritária
+
+1. **Imediato**: Corrigir configuração PostHog e analytics
+2. **Próxima semana**: Implementar restrições de permissões
+3. **Duas semanas**: Remover flags perigosas e melhorar CSP
+4. **Contínuo**: Adicionar validações e melhorar tratamento de erros
+
+Essas correções devem ser implementadas e testadas cuidadosamente antes do próximo release.
\ No newline at end of file
diff --git a/IMPROVEMENT_PLAN.md b/IMPROVEMENT_PLAN.md
new file mode 100644
index 000000000..4e953acb4
--- /dev/null
+++ b/IMPROVEMENT_PLAN.md
@@ -0,0 +1,164 @@
+# 🚀 Plano de Melhorias - Claudia
+
+## Resumo Executivo
+
+Este documento apresenta um plano detalhado de melhorias para o projeto Claudia, uma aplicação desktop para gerenciar sessões do Claude Code. A análise identificou várias áreas críticas que precisam de atenção para melhorar a funcionalidade, segurança e experiência do usuário.
+
+## 🔴 Problemas Críticos (Alta Prioridade)
+
+### 1. **Segurança**
+
+#### 1.1 Permissões Excessivas
+- **Problema**: O escopo do sistema de arquivos permite acesso a todo o diretório home (`$HOME/**`)
+- **Solução**: Restringir acesso apenas aos diretórios necessários (`.claude`, projetos específicos)
+- **Arquivo**: `src-tauri/tauri.conf.json`
+
+#### 1.2 CSP Insegura
+- **Problema**: Content Security Policy permite `unsafe-eval` e `unsafe-inline`
+- **Solução**: Refatorar código para evitar eval() e inline scripts, usar nonces para scripts necessários
+- **Arquivo**: `src-tauri/tauri.conf.json`
+
+#### 1.3 Flag Perigosa
+- **Problema**: Uso de `--dangerously-skip-permissions` em execuções do Claude
+- **Solução**: Implementar sistema de permissões apropriado ou pedir confirmação do usuário
+- **Arquivos**: `src-tauri/src/commands/claude.rs`, testes
+
+### 2. **Bugs de Funcionalidade**
+
+#### 2.1 PostHog Configuration
+- **Problema**: Campo `defaults: '2025-05-24'` incorreto na configuração do PostHog
+- **Solução**: Remover ou corrigir para campo válido como `enabled: true`
+- **Arquivo**: `src/main.tsx`
+
+#### 2.2 Analytics sem Consentimento
+- **Problema**: Analytics são inicializados antes do consentimento do usuário
+- **Solução**: Inicializar analytics apenas após consentimento
+- **Arquivo**: `src/main.tsx`
+
+## 🟡 Melhorias de Performance (Média Prioridade)
+
+### 3. **Otimizações de Frontend**
+
+#### 3.1 Bundle Size
+- **Problema**: Aplicação pode estar carregando bibliotecas desnecessárias
+- **Sugestões**:
+  - Implementar code splitting para componentes grandes
+  - Lazy loading para modais e componentes secundários
+  - Tree shaking mais agressivo
+
+#### 3.2 Re-renders Desnecessários
+- **Problema**: Possíveis re-renders em componentes complexos
+- **Solução**: 
+  - Adicionar React.memo em componentes puros
+  - Usar useMemo/useCallback onde apropriado
+  - Implementar React DevTools Profiler para análise
+
+### 4. **Otimizações de Backend**
+
+#### 4.1 Processamento de JSONL
+- **Problema**: Leitura completa de arquivos JSONL grandes pode ser lenta
+- **Solução**: Implementar streaming e paginação para arquivos grandes
+
+## 🟢 Melhorias de UX/UI (Baixa Prioridade)
+
+### 5. **Interface do Usuário**
+
+#### 5.1 Feedback Visual
+- **Sugestão**: Adicionar indicadores de loading mais informativos
+- **Implementar**: Skeleton screens durante carregamento
+- **Melhorar**: Animações de transição entre views
+
+#### 5.2 Tratamento de Erros
+- **Problema**: ErrorBoundary não captura stack traces completos
+- **Solução**: Melhorar logging de erros e adicionar botão para reportar bugs
+
+### 6. **Funcionalidades Novas**
+
+#### 6.1 Sistema de Notificações
+- Notificações desktop para conclusão de tarefas longas
+- Sistema de badges para indicar atividade
+
+#### 6.2 Atalhos de Teclado
+- Expandir atalhos além dos existentes
+- Adicionar customização de atalhos
+
+## 📋 Plano de Implementação
+
+### Fase 1: Correções Críticas (1-2 semanas)
+1. [ ] Corrigir configuração do PostHog
+2. [ ] Implementar consentimento antes de analytics
+3. [ ] Restringir permissões do sistema de arquivos
+4. [ ] Remover/substituir `--dangerously-skip-permissions`
+5. [ ] Melhorar CSP removendo unsafe directives
+
+### Fase 2: Melhorias de Segurança (2-3 semanas)
+1. [ ] Implementar validação de entrada em todos os comandos
+2. [ ] Adicionar rate limiting para operações sensíveis
+3. [ ] Implementar logging de segurança
+4. [ ] Adicionar testes de segurança automatizados
+
+### Fase 3: Performance (3-4 semanas)
+1. [ ] Implementar code splitting
+2. [ ] Otimizar bundle size
+3. [ ] Adicionar caching inteligente
+4. [ ] Implementar streaming para JSONL
+
+### Fase 4: UX/UI (4-5 semanas)
+1. [ ] Melhorar feedback visual
+2. [ ] Adicionar skeleton screens
+3. [ ] Implementar sistema de notificações
+4. [ ] Expandir atalhos de teclado
+
+## 🧪 Estratégia de Testes
+
+### Testes Unitários
+- Aumentar cobertura para 80%+
+- Focar em lógica crítica de negócio
+- Adicionar testes de componentes React
+
+### Testes de Integração
+- Testar fluxos completos end-to-end
+- Validar integração com Claude Code
+- Testar diferentes cenários de erro
+
+### Testes de Segurança
+- Implementar testes de penetração básicos
+- Validar sanitização de inputs
+- Testar limites de permissões
+
+## 📊 Métricas de Sucesso
+
+1. **Segurança**: Zero vulnerabilidades críticas
+2. **Performance**: Tempo de inicialização < 2s
+3. **Estabilidade**: < 1% de taxa de crashes
+4. **UX**: > 90% de satisfação do usuário
+5. **Testes**: > 80% de cobertura de código
+
+## 🔄 Manutenção Contínua
+
+### Monitoramento
+- Implementar Sentry para tracking de erros
+- Dashboard de métricas de performance
+- Alertas para problemas críticos
+
+### Atualizações
+- Processo de CI/CD robusto
+- Versionamento semântico
+- Changelog automático
+
+## 💡 Recomendações Adicionais
+
+1. **Documentação**: Melhorar documentação inline e criar guia de contribuição
+2. **Acessibilidade**: Adicionar suporte ARIA e navegação por teclado
+3. **Internacionalização**: Preparar app para múltiplos idiomas
+4. **Telemetria**: Implementar telemetria opcional mais detalhada
+5. **Backup**: Sistema de backup automático de sessões importantes
+
+## Conclusão
+
+Este plano fornece um caminho claro para melhorar significativamente a qualidade, segurança e experiência do usuário do Claudia. A implementação deve ser feita de forma incremental, priorizando correções críticas de segurança e bugs antes de melhorias de performance e UX.
+
+---
+
+**Última atualização**: ${new Date().toISOString()}
+**Versão do documento**: 1.0.0
\ No newline at end of file
diff --git a/QUICK_FIXES_CHECKLIST.md b/QUICK_FIXES_CHECKLIST.md
new file mode 100644
index 000000000..2e2e3c03c
--- /dev/null
+++ b/QUICK_FIXES_CHECKLIST.md
@@ -0,0 +1,150 @@
+# ✅ Checklist de Correções Rápidas
+
+## 🚨 Correções Imediatas (< 1 hora cada)
+
+### 1. Bug do PostHog (5 minutos)
+- [ ] Abrir `src/main.tsx`
+- [ ] Linha 23: Remover `defaults: '2025-05-24',`
+- [ ] Substituir por `enabled: false,`
+- [ ] Testar inicialização
+
+### 2. Analytics após Consentimento (30 minutos)
+- [ ] Modificar `src/main.tsx` para não chamar `analytics.initialize()` automaticamente
+- [ ] Mover inicialização para após consentimento em `AnalyticsConsent.tsx`
+- [ ] Testar fluxo de consentimento
+
+### 3. Melhorar ErrorBoundary (20 minutos)
+- [ ] Adicionar captura de `error.stack` no `componentDidCatch`
+- [ ] Adicionar timestamp aos erros
+- [ ] Implementar botão "Copiar detalhes do erro"
+
+### 4. Adicionar Validação Básica (45 minutos)
+- [ ] Instalar zod: `bun add zod`
+- [ ] Criar `src/lib/validation.ts`
+- [ ] Validar inputs em `execute_claude_code`
+- [ ] Validar paths de arquivo
+
+### 5. Limpar Imports Não Usados (15 minutos)
+- [ ] Rodar análise de imports não usados
+- [ ] Remover dependências não utilizadas
+- [ ] Atualizar package.json
+
+## 🔧 Correções de 1-2 Horas
+
+### 6. Restringir Permissões FS (1 hora)
+- [ ] Modificar `tauri.conf.json`
+- [ ] Limitar scope para diretórios específicos
+- [ ] Adicionar deny list para diretórios sensíveis
+- [ ] Testar acesso a arquivos
+
+### 7. Remover Flag Perigosa dos Testes (1 hora)
+- [ ] Buscar todos usos de `--dangerously-skip-permissions`
+- [ ] Implementar alternativa segura
+- [ ] Atualizar testes
+- [ ] Verificar se testes ainda passam
+
+### 8. Adicionar Loading States (1.5 horas)
+- [ ] Identificar componentes sem loading states
+- [ ] Adicionar skeleton screens
+- [ ] Melhorar feedback visual
+- [ ] Testar UX
+
+## 📊 Melhorias de Performance Rápidas
+
+### 9. React.memo em Componentes (30 minutos)
+- [ ] Adicionar React.memo em:
+  - [ ] ProjectList
+  - [ ] SessionList
+  - [ ] FileEntry
+  - [ ] AgentCard
+
+### 10. Lazy Loading de Modais (45 minutos)
+- [ ] Converter imports para dynamic imports:
+  - [ ] AgentsModal
+  - [ ] NFOCredits
+  - [ ] ClaudeBinaryDialog
+  - [ ] Settings
+
+## 🧹 Limpeza de Código
+
+### 11. Remover Código Morto (20 minutos)
+- [ ] Remover componentes não utilizados
+- [ ] Limpar funções comentadas
+- [ ] Remover logs de debug em produção
+
+### 12. Consistência de Tipos (30 minutos)
+- [ ] Verificar any types
+- [ ] Adicionar tipos faltantes
+- [ ] Usar tipos do Tauri onde apropriado
+
+## 🔍 Verificações de Qualidade
+
+### 13. Lint e Format (10 minutos)
+```bash
+# Rodar em sequência:
+bun run check
+cd src-tauri && cargo fmt
+cd src-tauri && cargo clippy
+```
+
+### 14. Build de Produção (15 minutos)
+```bash
+# Testar build completo:
+bun run build
+bun run tauri build --debug
+```
+
+### 15. Testes Básicos (20 minutos)
+- [ ] Testar fluxo de criar novo projeto
+- [ ] Testar execução de agente
+- [ ] Testar navegação entre views
+- [ ] Verificar console por erros
+
+## 📝 Documentação Rápida
+
+### 16. Adicionar Comentários (30 minutos)
+- [ ] Documentar funções complexas
+- [ ] Adicionar JSDoc em funções públicas
+- [ ] Comentar lógica não óbvia
+
+### 17. README de Desenvolvimento (20 minutos)
+- [ ] Criar DEVELOPMENT.md
+- [ ] Documentar setup local
+- [ ] Listar comandos comuns
+- [ ] Adicionar troubleshooting
+
+## 🎯 Ordem de Prioridade Sugerida
+
+1. **Crítico** (fazer hoje):
+   - Items 1, 2, 3, 4
+
+2. **Importante** (fazer esta semana):
+   - Items 6, 7, 11, 13
+
+3. **Melhorias** (próxima semana):
+   - Items 8, 9, 10, 12
+
+4. **Nice to have** (quando possível):
+   - Items 5, 14, 15, 16, 17
+
+## 💡 Dicas para Implementação
+
+- Fazer commits pequenos e específicos
+- Testar cada mudança isoladamente
+- Criar branch para cada grupo de correções
+- Usar mensagens de commit descritivas
+- Rodar testes após cada mudança
+
+## 🚀 Resultado Esperado
+
+Após completar este checklist:
+- App mais estável e seguro
+- Melhor performance
+- Código mais limpo e maintível
+- Menos bugs em produção
+- Melhor experiência do usuário
+
+---
+
+**Tempo total estimado**: ~10 horas de trabalho focado
+**Impacto**: Alto - corrige problemas críticos e melhora qualidade geral
\ No newline at end of file
diff --git a/src-tauri/src/commands/agents.rs b/src-tauri/src/commands/agents.rs
index 43d8346b7..efbc9d000 100644
--- a/src-tauri/src/commands/agents.rs
+++ b/src-tauri/src/commands/agents.rs
@@ -763,7 +763,6 @@ pub async fn execute_agent(
         "--output-format".to_string(),
         "stream-json".to_string(),
         "--verbose".to_string(),
-        "--dangerously-skip-permissions".to_string(),
     ];
 
     // Execute based on whether we should use sidecar or system binary
diff --git a/src-tauri/src/commands/claude.rs b/src-tauri/src/commands/claude.rs
index c1f669d6a..179fabc4d 100644
--- a/src-tauri/src/commands/claude.rs
+++ b/src-tauri/src/commands/claude.rs
@@ -820,6 +820,29 @@ pub async fn execute_claude_code(
     prompt: String,
     model: String,
 ) -> Result<(), String> {
+    // Validate inputs
+    if project_path.is_empty() {
+        return Err("Project path cannot be empty".to_string());
+    }
+    if project_path.contains("..") {
+        return Err("Path traversal not allowed".to_string());
+    }
+    if prompt.is_empty() {
+        return Err("Prompt cannot be empty".to_string());
+    }
+    if prompt.len() > 10000 {
+        return Err("Prompt is too long (max 10000 characters)".to_string());
+    }
+    if !matches!(model.as_str(), 
+        "claude-3-opus-20240229" | 
+        "claude-3-sonnet-20240229" | 
+        "claude-3-haiku-20240307" |
+        "claude-3-5-sonnet-20241022" |
+        "claude-3-5-haiku-20241022"
+    ) {
+        return Err("Invalid model selected".to_string());
+    }
+    
     log::info!(
         "Starting new Claude Code session in: {} with model: {}",
         project_path,
@@ -836,7 +859,6 @@ pub async fn execute_claude_code(
         "--output-format".to_string(),
         "stream-json".to_string(),
         "--verbose".to_string(),
-        "--dangerously-skip-permissions".to_string(),
     ];
 
     let cmd = create_system_command(&claude_path, args, &project_path);
@@ -851,6 +873,29 @@ pub async fn continue_claude_code(
     prompt: String,
     model: String,
 ) -> Result<(), String> {
+    // Validate inputs
+    if project_path.is_empty() {
+        return Err("Project path cannot be empty".to_string());
+    }
+    if project_path.contains("..") {
+        return Err("Path traversal not allowed".to_string());
+    }
+    if prompt.is_empty() {
+        return Err("Prompt cannot be empty".to_string());
+    }
+    if prompt.len() > 10000 {
+        return Err("Prompt is too long (max 10000 characters)".to_string());
+    }
+    if !matches!(model.as_str(), 
+        "claude-3-opus-20240229" | 
+        "claude-3-sonnet-20240229" | 
+        "claude-3-haiku-20240307" |
+        "claude-3-5-sonnet-20241022" |
+        "claude-3-5-haiku-20241022"
+    ) {
+        return Err("Invalid model selected".to_string());
+    }
+    
     log::info!(
         "Continuing Claude Code conversation in: {} with model: {}",
         project_path,
@@ -868,7 +913,6 @@ pub async fn continue_claude_code(
         "--output-format".to_string(),
         "stream-json".to_string(),
         "--verbose".to_string(),
-        "--dangerously-skip-permissions".to_string(),
     ];
 
     let cmd = create_system_command(&claude_path, args, &project_path);
@@ -884,6 +928,36 @@ pub async fn resume_claude_code(
     prompt: String,
     model: String,
 ) -> Result<(), String> {
+    // Validate inputs
+    if project_path.is_empty() {
+        return Err("Project path cannot be empty".to_string());
+    }
+    if project_path.contains("..") {
+        return Err("Path traversal not allowed".to_string());
+    }
+    if session_id.is_empty() {
+        return Err("Session ID cannot be empty".to_string());
+    }
+    // Basic UUID format validation (8-4-4-4-12 format)
+    if session_id.len() != 36 || !session_id.chars().all(|c| c.is_ascii_hexdigit() || c == '-') {
+        return Err("Invalid session ID format".to_string());
+    }
+    if prompt.is_empty() {
+        return Err("Prompt cannot be empty".to_string());
+    }
+    if prompt.len() > 10000 {
+        return Err("Prompt is too long (max 10000 characters)".to_string());
+    }
+    if !matches!(model.as_str(), 
+        "claude-3-opus-20240229" | 
+        "claude-3-sonnet-20240229" | 
+        "claude-3-haiku-20240307" |
+        "claude-3-5-sonnet-20241022" |
+        "claude-3-5-haiku-20241022"
+    ) {
+        return Err("Invalid model selected".to_string());
+    }
+    
     log::info!(
         "Resuming Claude Code session: {} in: {} with model: {}",
         session_id,
@@ -903,7 +977,6 @@ pub async fn resume_claude_code(
         "--output-format".to_string(),
         "stream-json".to_string(),
         "--verbose".to_string(),
-        "--dangerously-skip-permissions".to_string(),
     ];
 
     let cmd = create_system_command(&claude_path, args, &project_path);
@@ -1235,6 +1308,12 @@ pub async fn list_directory_contents(directory_path: String) -> Result<Vec<FileE
         log::error!("Directory path is empty or whitespace");
         return Err("Directory path cannot be empty".to_string());
     }
+    
+    // Prevent path traversal
+    if directory_path.contains("..") {
+        log::error!("Path traversal attempt detected: {}", directory_path);
+        return Err("Path traversal not allowed".to_string());
+    }
 
     let path = PathBuf::from(&directory_path);
     log::debug!("Resolved path: {:?}", path);
@@ -1312,12 +1391,23 @@ pub async fn search_files(base_path: String, query: String) -> Result<Vec<FileEn
         log::error!("Base path is empty or whitespace");
         return Err("Base path cannot be empty".to_string());
     }
+    
+    // Prevent path traversal
+    if base_path.contains("..") {
+        log::error!("Path traversal attempt detected: {}", base_path);
+        return Err("Path traversal not allowed".to_string());
+    }
 
     // Check if query is empty
     if query.trim().is_empty() {
         log::warn!("Search query is empty, returning empty results");
         return Ok(Vec::new());
     }
+    
+    // Limit query length
+    if query.len() > 100 {
+        return Err("Search query is too long (max 100 characters)".to_string());
+    }
 
     let path = PathBuf::from(&base_path);
     log::debug!("Resolved search base path: {:?}", path);
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 0530fc2a2..4c207464e 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -18,7 +18,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self'; img-src 'self' asset: https://asset.localhost blob: data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-eval' https://app.posthog.com https://*.posthog.com https://*.i.posthog.com https://*.assets.i.posthog.com; connect-src 'self' ipc: https://ipc.localhost https://app.posthog.com https://*.posthog.com https://*.i.posthog.com",
+      "csp": "default-src 'self'; img-src 'self' asset: https://asset.localhost blob: data:; style-src 'self' 'unsafe-inline'; script-src 'self' https://app.posthog.com https://*.posthog.com; connect-src 'self' ipc: https://ipc.localhost https://app.posthog.com https://*.posthog.com https://*.i.posthog.com; font-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none';",
       "assetProtocol": {
         "enable": true,
         "scope": [
@@ -30,7 +30,27 @@
   "plugins": {
     "fs": {
       "scope": [
-        "$HOME/**"
+        "$HOME/.claude/**",
+        "$HOME/.claudia/**",
+        "$DOCUMENT/**",
+        "$DESKTOP/**",
+        "$HOME/Projects/**",
+        "$HOME/Documents/**",
+        "$HOME/Desktop/**"
+      ],
+      "deny": [
+        "$HOME/.ssh/**",
+        "$HOME/.gnupg/**",
+        "$HOME/.aws/**",
+        "$HOME/.config/gcloud/**",
+        "$HOME/.docker/**",
+        "$HOME/.kube/**",
+        "$HOME/.env",
+        "$HOME/.bashrc",
+        "$HOME/.zshrc",
+        "$HOME/.profile",
+        "$HOME/.gitconfig",
+        "$HOME/.npmrc"
       ],
       "allow": [
         "readFile",
diff --git a/src/App.tsx b/src/App.tsx
index 0d424fb74..d8fcb7cbb 100644
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -1,4 +1,4 @@
-import { useState, useEffect } from "react";
+import { useState, useEffect, lazy, Suspense } from "react";
 import { motion, AnimatePresence } from "framer-motion";
 import { Plus, Loader2, Bot, FolderCode } from "lucide-react";
 import { api, type Project, type Session, type ClaudeMdFile } from "@/lib/api";
@@ -13,21 +13,30 @@ import { RunningClaudeSessions } from "@/components/RunningClaudeSessions";
 import { Topbar } from "@/components/Topbar";
 import { MarkdownEditor } from "@/components/MarkdownEditor";
 import { ClaudeFileEditor } from "@/components/ClaudeFileEditor";
-import { Settings } from "@/components/Settings";
-import { CCAgents } from "@/components/CCAgents";
-import { UsageDashboard } from "@/components/UsageDashboard";
-import { MCPManager } from "@/components/MCPManager";
-import { NFOCredits } from "@/components/NFOCredits";
-import { ClaudeBinaryDialog } from "@/components/ClaudeBinaryDialog";
 import { Toast, ToastContainer } from "@/components/ui/toast";
-import { ProjectSettings } from '@/components/ProjectSettings';
 import { TabManager } from "@/components/TabManager";
 import { TabContent } from "@/components/TabContent";
-import { AgentsModal } from "@/components/AgentsModal";
 import { useTabState } from "@/hooks/useTabState";
 import { AnalyticsConsentBanner } from "@/components/AnalyticsConsent";
 import { useAppLifecycle, useTrackEvent } from "@/hooks";
 
+// Lazy load heavy components
+const Settings = lazy(() => import("@/components/Settings").then(m => ({ default: m.Settings })));
+const CCAgents = lazy(() => import("@/components/CCAgents").then(m => ({ default: m.CCAgents })));
+const UsageDashboard = lazy(() => import("@/components/UsageDashboard").then(m => ({ default: m.UsageDashboard })));
+const MCPManager = lazy(() => import("@/components/MCPManager").then(m => ({ default: m.MCPManager })));
+const NFOCredits = lazy(() => import("@/components/NFOCredits").then(m => ({ default: m.NFOCredits })));
+const ClaudeBinaryDialog = lazy(() => import("@/components/ClaudeBinaryDialog").then(m => ({ default: m.ClaudeBinaryDialog })));
+const ProjectSettings = lazy(() => import('@/components/ProjectSettings').then(m => ({ default: m.ProjectSettings })));
+const AgentsModal = lazy(() => import("@/components/AgentsModal").then(m => ({ default: m.AgentsModal })));
+
+// Loading fallback component
+const LoadingFallback = () => (
+  <div className="flex items-center justify-center h-full">
+    <Loader2 className="h-8 w-8 animate-spin text-muted-foreground" />
+  </div>
+);
+
 type View = 
   | "welcome" 
   | "projects" 
@@ -293,9 +302,11 @@ function AppContent() {
 
       case "cc-agents":
         return (
-          <CCAgents 
-            onBack={() => handleViewChange("welcome")} 
-          />
+          <Suspense fallback={<LoadingFallback />}>
+            <CCAgents 
+              onBack={() => handleViewChange("welcome")} 
+            />
+          </Suspense>
         );
 
       case "editor":
@@ -308,7 +319,9 @@ function AppContent() {
       case "settings":
         return (
           <div className="flex-1 flex flex-col" style={{ minHeight: 0 }}>
-            <Settings onBack={() => handleViewChange("welcome")} />
+            <Suspense fallback={<LoadingFallback />}>
+              <Settings onBack={() => handleViewChange("welcome")} />
+            </Suspense>
           </div>
         );
       
@@ -447,24 +460,30 @@ function AppContent() {
       
       case "usage-dashboard":
         return (
-          <UsageDashboard onBack={() => handleViewChange("welcome")} />
+          <Suspense fallback={<LoadingFallback />}>
+            <UsageDashboard onBack={() => handleViewChange("welcome")} />
+          </Suspense>
         );
       
       case "mcp":
         return (
-          <MCPManager onBack={() => handleViewChange("welcome")} />
+          <Suspense fallback={<LoadingFallback />}>
+            <MCPManager onBack={() => handleViewChange("welcome")} />
+          </Suspense>
         );
       
       case "project-settings":
         if (projectForSettings) {
           return (
-            <ProjectSettings
-              project={projectForSettings}
-              onBack={() => {
-                setProjectForSettings(null);
-                handleViewChange(previousView || "projects");
-              }}
-            />
+            <Suspense fallback={<LoadingFallback />}>
+              <ProjectSettings
+                project={projectForSettings}
+                onBack={() => {
+                  setProjectForSettings(null);
+                  handleViewChange(previousView || "projects");
+                }}
+              />
+            </Suspense>
           );
         }
         break;
@@ -495,25 +514,33 @@ function AppContent() {
       </div>
       
       {/* NFO Credits Modal */}
-      {showNFO && <NFOCredits onClose={() => setShowNFO(false)} />}
+      {showNFO && (
+        <Suspense fallback={<LoadingFallback />}>
+          <NFOCredits onClose={() => setShowNFO(false)} />
+        </Suspense>
+      )}
       
       {/* Agents Modal */}
-      <AgentsModal 
-        open={showAgentsModal} 
-        onOpenChange={setShowAgentsModal} 
-      />
+      <Suspense fallback={<LoadingFallback />}>
+        <AgentsModal 
+          open={showAgentsModal} 
+          onOpenChange={setShowAgentsModal} 
+        />
+      </Suspense>
       
       {/* Claude Binary Dialog */}
-      <ClaudeBinaryDialog
-        open={showClaudeBinaryDialog}
-        onOpenChange={setShowClaudeBinaryDialog}
-        onSuccess={() => {
-          setToast({ message: "Claude binary path saved successfully", type: "success" });
-          // Trigger a refresh of the Claude version check
-          window.location.reload();
-        }}
-        onError={(message) => setToast({ message, type: "error" })}
-      />
+      <Suspense fallback={<LoadingFallback />}>
+        <ClaudeBinaryDialog
+          open={showClaudeBinaryDialog}
+          onOpenChange={setShowClaudeBinaryDialog}
+          onSuccess={() => {
+            setToast({ message: "Claude binary path saved successfully", type: "success" });
+            // Trigger a refresh of the Claude version check
+            window.location.reload();
+          }}
+          onError={(message) => setToast({ message, type: "error" })}
+        />
+      </Suspense>
       
       {/* Toast Container */}
       <ToastContainer>
diff --git a/src/components/ErrorBoundary.tsx b/src/components/ErrorBoundary.tsx
index 591c99e37..068af67b3 100644
--- a/src/components/ErrorBoundary.tsx
+++ b/src/components/ErrorBoundary.tsx
@@ -28,8 +28,33 @@ export class ErrorBoundary extends Component<ErrorBoundaryProps, ErrorBoundarySt
   }
 
   componentDidCatch(error: Error, errorInfo: React.ErrorInfo) {
-    // Log the error to console
-    console.error("Error caught by boundary:", error, errorInfo);
+    // Capture detailed error information
+    const errorDetails = {
+      message: error.message,
+      stack: error.stack,
+      componentStack: errorInfo.componentStack,
+      timestamp: new Date().toISOString(),
+      userAgent: navigator.userAgent,
+      url: window.location.href,
+    };
+    
+    // Log detailed error to console
+    console.error("Error caught by boundary:", errorDetails);
+    
+    // Save error to localStorage for debugging
+    this.saveErrorToLocalStorage(errorDetails);
+  }
+  
+  private saveErrorToLocalStorage(error: any) {
+    try {
+      const errors = JSON.parse(localStorage.getItem('claudia_errors') || '[]');
+      errors.push(error);
+      // Keep only last 10 errors
+      if (errors.length > 10) errors.shift();
+      localStorage.setItem('claudia_errors', JSON.stringify(errors));
+    } catch (e) {
+      console.error('Failed to save error to localStorage:', e);
+    }
   }
 
   reset = () => {
@@ -60,18 +85,39 @@ export class ErrorBoundary extends Component<ErrorBoundaryProps, ErrorBoundarySt
                       <summary className="text-sm cursor-pointer text-muted-foreground hover:text-foreground">
                         Error details
                       </summary>
-                      <pre className="mt-2 text-xs bg-muted p-2 rounded overflow-auto">
+                      <pre className="mt-2 text-xs bg-muted p-2 rounded overflow-auto max-h-32">
                         {this.state.error.message}
+                        {this.state.error.stack && (
+                          <>
+                            {"\n\nStack trace:\n"}
+                            {this.state.error.stack}
+                          </>
+                        )}
                       </pre>
                     </details>
                   )}
-                  <Button
-                    onClick={this.reset}
-                    size="sm"
-                    className="mt-4"
-                  >
-                    Try again
-                  </Button>
+                  <div className="flex gap-2 mt-4">
+                    <Button
+                      onClick={this.reset}
+                      size="sm"
+                    >
+                      Try again
+                    </Button>
+                    <Button
+                      onClick={() => {
+                        const errorData = {
+                          message: this.state.error?.message,
+                          stack: this.state.error?.stack,
+                          timestamp: new Date().toISOString(),
+                        };
+                        navigator.clipboard.writeText(JSON.stringify(errorData, null, 2));
+                      }}
+                      size="sm"
+                      variant="outline"
+                    >
+                      Copy error details
+                    </Button>
+                  </div>
                 </div>
               </div>
             </CardContent>
diff --git a/src/components/ProjectList.tsx b/src/components/ProjectList.tsx
index 058de9604..9bef58912 100644
--- a/src/components/ProjectList.tsx
+++ b/src/components/ProjectList.tsx
@@ -1,4 +1,4 @@
-import React, { useState } from "react";
+import React, { useState, memo, useCallback } from "react";
 import { motion } from "framer-motion";
 import { 
   FolderOpen, 
@@ -55,6 +55,98 @@ const getProjectName = (path: string): string => {
   return parts[parts.length - 1] || path;
 };
 
+/**
+ * Individual project card component - Memoized to prevent unnecessary re-renders
+ */
+const ProjectCard = memo<{ 
+  project: Project; 
+  index: number;
+  onProjectClick: (project: Project) => void;
+  onProjectSettings?: (project: Project) => void;
+}>(({ project, index, onProjectClick, onProjectSettings }) => {
+  const handleClick = useCallback(() => {
+    onProjectClick(project);
+  }, [project, onProjectClick]);
+  
+  const handleSettings = useCallback((e: React.MouseEvent) => {
+    e.stopPropagation();
+    onProjectSettings?.(project);
+  }, [project, onProjectSettings]);
+  
+  return (
+    <motion.div
+      initial={{ opacity: 0, y: 20 }}
+      animate={{ opacity: 1, y: 0 }}
+      transition={{
+        duration: 0.3,
+        delay: index * 0.05,
+        ease: [0.4, 0, 0.2, 1],
+      }}
+    >
+      <Card
+        className="p-4 hover:shadow-md transition-all duration-200 cursor-pointer group h-full"
+        onClick={handleClick}
+      >
+        <div className="flex flex-col h-full">
+          <div className="flex-1">
+            <div className="flex items-start justify-between mb-2">
+              <div className="flex items-center gap-2 flex-1 min-w-0">
+                <FolderOpen className="h-5 w-5 text-primary shrink-0" />
+                <h3 className="font-semibold text-base truncate">
+                  {getProjectName(project.path)}
+                </h3>
+              </div>
+              {project.sessions.length > 0 && (
+                <Badge variant="secondary" className="shrink-0 ml-2">
+                  {project.sessions.length}
+                </Badge>
+              )}
+            </div>
+            
+            <p className="text-sm text-muted-foreground mb-3 font-mono truncate">
+              {project.path}
+            </p>
+          </div>
+          
+          <div className="flex items-center justify-between">
+            <div className="flex items-center gap-3 text-xs text-muted-foreground">
+              <div className="flex items-center gap-1">
+                <Calendar className="h-3 w-3" />
+                <span>{formatTimeAgo(project.created_at * 1000)}</span>
+              </div>
+              <div className="flex items-center gap-1">
+                <FileText className="h-3 w-3" />
+                <span>{project.sessions.length}</span>
+              </div>
+            </div>
+            
+            <div className="flex items-center gap-1 opacity-0 group-hover:opacity-100 transition-opacity">
+              {onProjectSettings && (
+                <DropdownMenu>
+                  <DropdownMenuTrigger asChild onClick={(e) => e.stopPropagation()}>
+                    <Button variant="ghost" size="sm" className="h-8 w-8 p-0">
+                      <MoreVertical className="h-4 w-4" />
+                    </Button>
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end">
+                    <DropdownMenuItem onClick={handleSettings}>
+                      <Settings className="h-4 w-4 mr-2" />
+                      Hooks
+                    </DropdownMenuItem>
+                  </DropdownMenuContent>
+                </DropdownMenu>
+              )}
+              <ChevronRight className="h-4 w-4 text-muted-foreground" />
+            </div>
+          </div>
+        </div>
+      </Card>
+    </motion.div>
+  );
+});
+
+ProjectCard.displayName = 'ProjectCard';
+
 /**
  * ProjectList component - Displays a paginated list of projects with hover animations
  * 
@@ -64,7 +156,7 @@ const getProjectName = (path: string): string => {
  *   onProjectClick={(project) => console.log('Selected:', project)}
  * />
  */
-export const ProjectList: React.FC<ProjectListProps> = ({
+export const ProjectList: React.FC<ProjectListProps> = memo(({
   projects,
   onProjectClick,
   onProjectSettings,
@@ -87,80 +179,13 @@ export const ProjectList: React.FC<ProjectListProps> = ({
     <div className={cn("space-y-4", className)}>
       <div className="grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4">
         {currentProjects.map((project, index) => (
-          <motion.div
+          <ProjectCard
             key={project.id}
-            initial={{ opacity: 0, y: 20 }}
-            animate={{ opacity: 1, y: 0 }}
-            transition={{
-              duration: 0.3,
-              delay: index * 0.05,
-              ease: [0.4, 0, 0.2, 1],
-            }}
-          >
-            <Card
-              className="p-4 hover:shadow-md transition-all duration-200 cursor-pointer group h-full"
-              onClick={() => onProjectClick(project)}
-            >
-              <div className="flex flex-col h-full">
-                <div className="flex-1">
-                  <div className="flex items-start justify-between mb-2">
-                    <div className="flex items-center gap-2 flex-1 min-w-0">
-                      <FolderOpen className="h-5 w-5 text-primary shrink-0" />
-                      <h3 className="font-semibold text-base truncate">
-                        {getProjectName(project.path)}
-                      </h3>
-                    </div>
-                    {project.sessions.length > 0 && (
-                      <Badge variant="secondary" className="shrink-0 ml-2">
-                        {project.sessions.length}
-                      </Badge>
-                    )}
-                  </div>
-                  
-                  <p className="text-sm text-muted-foreground mb-3 font-mono truncate">
-                    {project.path}
-                  </p>
-                </div>
-                
-                <div className="flex items-center justify-between">
-                  <div className="flex items-center gap-3 text-xs text-muted-foreground">
-                    <div className="flex items-center gap-1">
-                      <Calendar className="h-3 w-3" />
-                      <span>{formatTimeAgo(project.created_at * 1000)}</span>
-                    </div>
-                    <div className="flex items-center gap-1">
-                      <FileText className="h-3 w-3" />
-                      <span>{project.sessions.length}</span>
-                    </div>
-                  </div>
-                  
-                  <div className="flex items-center gap-1 opacity-0 group-hover:opacity-100 transition-opacity">
-                    {onProjectSettings && (
-                      <DropdownMenu>
-                        <DropdownMenuTrigger asChild onClick={(e) => e.stopPropagation()}>
-                          <Button variant="ghost" size="sm" className="h-8 w-8 p-0">
-                            <MoreVertical className="h-4 w-4" />
-                          </Button>
-                        </DropdownMenuTrigger>
-                        <DropdownMenuContent align="end">
-                          <DropdownMenuItem
-                            onClick={(e) => {
-                              e.stopPropagation();
-                              onProjectSettings(project);
-                            }}
-                          >
-                            <Settings className="h-4 w-4 mr-2" />
-                            Hooks
-                          </DropdownMenuItem>
-                        </DropdownMenuContent>
-                      </DropdownMenu>
-                    )}
-                    <ChevronRight className="h-4 w-4 text-muted-foreground" />
-                  </div>
-                </div>
-              </div>
-            </Card>
-          </motion.div>
+            project={project}
+            index={index}
+            onProjectClick={onProjectClick}
+            onProjectSettings={onProjectSettings}
+          />
         ))}
       </div>
       
@@ -171,4 +196,6 @@ export const ProjectList: React.FC<ProjectListProps> = ({
       />
     </div>
   );
-}; 
+});
+
+ProjectList.displayName = 'ProjectList'; 
diff --git a/src/components/SessionList.tsx b/src/components/SessionList.tsx
index 7b0a2827f..02cc956b0 100644
--- a/src/components/SessionList.tsx
+++ b/src/components/SessionList.tsx
@@ -1,4 +1,4 @@
-import React, { useState } from "react";
+import React, { useState, memo, useCallback } from "react";
 import { motion, AnimatePresence } from "framer-motion";
 import { FileText, ArrowLeft, Calendar, Clock, MessageSquare } from "lucide-react";
 import { Card, CardContent } from "@/components/ui/card";
@@ -38,6 +38,95 @@ interface SessionListProps {
 
 const ITEMS_PER_PAGE = 5;
 
+/**
+ * Individual session card component - Memoized to prevent unnecessary re-renders
+ */
+const SessionCard = memo<{
+  session: Session;
+  index: number;
+  projectPath: string;
+  onSessionClick?: (session: Session) => void;
+}>(({ session, index, projectPath, onSessionClick }) => {
+  const handleClick = useCallback(() => {
+    // Emit a special event for Claude Code session navigation
+    const event = new CustomEvent('claude-session-selected', { 
+      detail: { session, projectPath } 
+    });
+    window.dispatchEvent(event);
+    onSessionClick?.(session);
+  }, [session, projectPath, onSessionClick]);
+  
+  return (
+    <motion.div
+      initial={{ opacity: 0, y: 20 }}
+      animate={{ opacity: 1, y: 0 }}
+      exit={{ opacity: 0, y: -20 }}
+      transition={{
+        duration: 0.3,
+        delay: index * 0.05,
+        ease: [0.4, 0, 0.2, 1],
+      }}
+    >
+      <Card
+        className={cn(
+          "transition-all hover:shadow-md hover:scale-[1.01] active:scale-[0.99] cursor-pointer",
+          session.todo_data && "border-l-4 border-l-primary"
+        )}
+        onClick={handleClick}
+      >
+        <CardContent className="p-3">
+          <div className="space-y-2">
+            <div className="flex items-start justify-between">
+              <div className="flex items-start space-x-3 flex-1 min-w-0">
+                <FileText className="h-4 w-4 text-muted-foreground mt-0.5 flex-shrink-0" />
+                <div className="space-y-1 flex-1 min-w-0">
+                  <p className="font-mono text-xs text-muted-foreground">{session.id}</p>
+                  
+                  {/* First message preview */}
+                  {session.first_message && (
+                    <div className="space-y-1">
+                      <div className="flex items-center space-x-1 text-xs text-muted-foreground">
+                        <MessageSquare className="h-3 w-3" />
+                        <span>First message:</span>
+                      </div>
+                      <p className="text-xs line-clamp-2 text-foreground/80">
+                        {truncateText(getFirstLine(session.first_message), 100)}
+                      </p>
+                    </div>
+                  )}
+                  
+                  {/* Metadata */}
+                  <div className="flex items-center space-x-3 text-xs text-muted-foreground">
+                    {/* Message timestamp if available, otherwise file creation time */}
+                    <div className="flex items-center space-x-1">
+                      <Clock className="h-3 w-3" />
+                      <span>
+                        {session.message_timestamp 
+                          ? formatISOTimestamp(session.message_timestamp)
+                          : formatUnixTimestamp(session.created_at)
+                        }
+                      </span>
+                    </div>
+                    
+                    {session.todo_data && (
+                      <div className="flex items-center space-x-1">
+                        <Calendar className="h-3 w-3" />
+                        <span>Has todo</span>
+                      </div>
+                    )}
+                  </div>
+                </div>
+              </div>
+            </div>
+          </div>
+        </CardContent>
+      </Card>
+    </motion.div>
+  );
+});
+
+SessionCard.displayName = 'SessionCard';
+
 /**
  * SessionList component - Displays paginated sessions for a specific project
  * 
@@ -49,7 +138,7 @@ const ITEMS_PER_PAGE = 5;
  *   onSessionClick={(session) => console.log('Selected session:', session)}
  * />
  */
-export const SessionList: React.FC<SessionListProps> = ({
+export const SessionList: React.FC<SessionListProps> = memo(({
   sessions,
   projectPath,
   onBack,
@@ -111,79 +200,13 @@ export const SessionList: React.FC<SessionListProps> = ({
       <AnimatePresence mode="popLayout">
         <div className="space-y-2">
           {currentSessions.map((session, index) => (
-            <motion.div
+            <SessionCard
               key={session.id}
-              initial={{ opacity: 0, y: 20 }}
-              animate={{ opacity: 1, y: 0 }}
-              exit={{ opacity: 0, y: -20 }}
-              transition={{
-                duration: 0.3,
-                delay: index * 0.05,
-                ease: [0.4, 0, 0.2, 1],
-              }}
-            >
-              <Card
-                className={cn(
-                  "transition-all hover:shadow-md hover:scale-[1.01] active:scale-[0.99] cursor-pointer",
-                  session.todo_data && "border-l-4 border-l-primary"
-                )}
-                onClick={() => {
-                  // Emit a special event for Claude Code session navigation
-                  const event = new CustomEvent('claude-session-selected', { 
-                    detail: { session, projectPath } 
-                  });
-                  window.dispatchEvent(event);
-                  onSessionClick?.(session);
-                }}
-              >
-                <CardContent className="p-3">
-                  <div className="space-y-2">
-                    <div className="flex items-start justify-between">
-                      <div className="flex items-start space-x-3 flex-1 min-w-0">
-                        <FileText className="h-4 w-4 text-muted-foreground mt-0.5 flex-shrink-0" />
-                        <div className="space-y-1 flex-1 min-w-0">
-                          <p className="font-mono text-xs text-muted-foreground">{session.id}</p>
-                          
-                          {/* First message preview */}
-                          {session.first_message && (
-                            <div className="space-y-1">
-                              <div className="flex items-center space-x-1 text-xs text-muted-foreground">
-                                <MessageSquare className="h-3 w-3" />
-                                <span>First message:</span>
-                              </div>
-                              <p className="text-xs line-clamp-2 text-foreground/80">
-                                {truncateText(getFirstLine(session.first_message), 100)}
-                              </p>
-                            </div>
-                          )}
-                          
-                          {/* Metadata */}
-                          <div className="flex items-center space-x-3 text-xs text-muted-foreground">
-                            {/* Message timestamp if available, otherwise file creation time */}
-                            <div className="flex items-center space-x-1">
-                              <Clock className="h-3 w-3" />
-                              <span>
-                                {session.message_timestamp 
-                                  ? formatISOTimestamp(session.message_timestamp)
-                                  : formatUnixTimestamp(session.created_at)
-                                }
-                              </span>
-                            </div>
-                            
-                            {session.todo_data && (
-                              <div className="flex items-center space-x-1">
-                                <Calendar className="h-3 w-3" />
-                                <span>Has todo</span>
-                              </div>
-                            )}
-                          </div>
-                        </div>
-                      </div>
-                    </div>
-                  </div>
-                </CardContent>
-              </Card>
-            </motion.div>
+              session={session}
+              index={index}
+              projectPath={projectPath}
+              onSessionClick={onSessionClick}
+            />
           ))}
         </div>
       </AnimatePresence>
@@ -195,4 +218,6 @@ export const SessionList: React.FC<SessionListProps> = ({
       />
     </div>
   );
-}; 
\ No newline at end of file
+});
+
+SessionList.displayName = 'SessionList'; 
\ No newline at end of file
diff --git a/src/lib/validation.ts b/src/lib/validation.ts
new file mode 100644
index 000000000..11442f58b
--- /dev/null
+++ b/src/lib/validation.ts
@@ -0,0 +1,169 @@
+import { z } from 'zod';
+
+/**
+ * Schema for validating file paths
+ * Prevents path traversal attacks and null bytes
+ */
+export const FilePathSchema = z.string()
+  .min(1, "Path cannot be empty")
+  .refine((path) => !path.includes('..'), "Path traversal not allowed")
+  .refine((path) => !path.includes('\0'), "Null bytes not allowed in path")
+  .refine((path) => !path.includes('~'), "Home directory shortcuts not allowed");
+
+/**
+ * Schema for validating project paths
+ */
+export const ProjectPathSchema = FilePathSchema
+  .refine((path) => path.startsWith('/'), "Project path must be absolute");
+
+/**
+ * Schema for validating prompts
+ */
+export const PromptSchema = z.string()
+  .min(1, "Prompt cannot be empty")
+  .max(10000, "Prompt is too long (max 10000 characters)")
+  .refine((prompt) => !prompt.includes('\0'), "Null bytes not allowed in prompt");
+
+/**
+ * Schema for validating model names
+ */
+export const ModelSchema = z.enum([
+  'claude-3-opus-20240229',
+  'claude-3-sonnet-20240229',
+  'claude-3-haiku-20240307',
+  'claude-3-5-sonnet-20241022',
+  'claude-3-5-haiku-20241022'
+], {
+  errorMap: () => ({ message: "Invalid model selected" })
+});
+
+/**
+ * Schema for validating session IDs
+ */
+export const SessionIdSchema = z.string()
+  .uuid("Invalid session ID format");
+
+/**
+ * Schema for Claude command execution
+ */
+export const ClaudeCommandSchema = z.object({
+  projectPath: ProjectPathSchema,
+  prompt: PromptSchema,
+  model: ModelSchema,
+});
+
+/**
+ * Schema for resuming Claude sessions
+ */
+export const ResumeClaudeSchema = z.object({
+  projectPath: ProjectPathSchema,
+  sessionId: SessionIdSchema,
+  prompt: PromptSchema,
+  model: ModelSchema,
+});
+
+/**
+ * Schema for agent creation
+ */
+export const AgentSchema = z.object({
+  name: z.string().min(1).max(100),
+  icon: z.string().max(100),
+  system_prompt: z.string().min(1).max(5000),
+  default_task: z.string().max(1000).optional(),
+  model: ModelSchema,
+  enable_file_read: z.boolean(),
+  enable_file_write: z.boolean(),
+  enable_network: z.boolean(),
+  hooks: z.string().optional(),
+});
+
+/**
+ * Schema for file operations
+ */
+export const FileOperationSchema = z.object({
+  filePath: FilePathSchema,
+  content: z.string().optional(),
+});
+
+/**
+ * Schema for directory listing
+ */
+export const DirectoryListSchema = z.object({
+  directoryPath: FilePathSchema,
+});
+
+/**
+ * Schema for search operations
+ */
+export const SearchSchema = z.object({
+  basePath: FilePathSchema,
+  query: z.string().min(1).max(100),
+});
+
+/**
+ * Validation helper functions
+ */
+export function validateClaudeCommand(data: unknown) {
+  try {
+    return ClaudeCommandSchema.parse(data);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      throw new Error(`Validation error: ${error.errors.map(e => e.message).join(', ')}`);
+    }
+    throw error;
+  }
+}
+
+export function validateResumeCommand(data: unknown) {
+  try {
+    return ResumeClaudeSchema.parse(data);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      throw new Error(`Validation error: ${error.errors.map(e => e.message).join(', ')}`);
+    }
+    throw error;
+  }
+}
+
+export function validateAgent(data: unknown) {
+  try {
+    return AgentSchema.parse(data);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      throw new Error(`Validation error: ${error.errors.map(e => e.message).join(', ')}`);
+    }
+    throw error;
+  }
+}
+
+export function validateFilePath(path: string): string {
+  try {
+    return FilePathSchema.parse(path);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      throw new Error(`Invalid file path: ${error.errors[0].message}`);
+    }
+    throw error;
+  }
+}
+
+export function validateProjectPath(path: string): string {
+  try {
+    return ProjectPathSchema.parse(path);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      throw new Error(`Invalid project path: ${error.errors[0].message}`);
+    }
+    throw error;
+  }
+}
+
+/**
+ * Sanitize user input for display
+ */
+export function sanitizeForDisplay(input: string): string {
+  return input
+    .replace(/[<>]/g, '') // Remove HTML tags
+    .replace(/javascript:/gi, '') // Remove javascript: protocol
+    .trim();
+}
\ No newline at end of file
diff --git a/src/main.tsx b/src/main.tsx
index f7d8f21e8..64655c45a 100644
--- a/src/main.tsx
+++ b/src/main.tsx
@@ -3,13 +3,13 @@ import ReactDOM from "react-dom/client";
 import App from "./App";
 import { ErrorBoundary } from "./components/ErrorBoundary";
 import { AnalyticsErrorBoundary } from "./components/AnalyticsErrorBoundary";
-import { analytics, resourceMonitor } from "./lib/analytics";
+import { resourceMonitor } from "./lib/analytics";
 import { PostHogProvider } from "posthog-js/react";
 import "./assets/shimmer.css";
 import "./styles.css";
 
-// Initialize analytics before rendering
-analytics.initialize();
+// Analytics will be initialized after user consent
+// analytics.initialize();
 
 // Start resource monitoring (check every 2 minutes)
 resourceMonitor.startMonitoring(120000);
@@ -20,9 +20,9 @@ ReactDOM.createRoot(document.getElementById("root") as HTMLElement).render(
       apiKey={import.meta.env.VITE_PUBLIC_POSTHOG_KEY}
       options={{
         api_host: import.meta.env.VITE_PUBLIC_POSTHOG_HOST,
-        defaults: '2025-05-24',
         capture_exceptions: true,
         debug: import.meta.env.MODE === "development",
+        opt_out_capturing_by_default: true, // Disabled by default until consent
       }}
     >
       <ErrorBoundary>