Failsafes

The agents work on your code on their own. Failsafes are hard limits that Coodoo always enforces, no matter what an agent tries or what a goal says. They are always on and can't be turned off.

You'll find them under Settings → Failsafes, under Always on.

The rules

Rule	What it means
Never delete a repository	Coodoo can't delete, archive, transfer or make public a repository, not even when a goal or you yourself ask for it. A goal for code in your app that works with repositories or issues (for example an API that archives issues) is fine
Only GitHub actions that are allowed in advance	Reading, creating a repository, opening, updating and merging a pull request (only for a protected branch or a step in the flow), putting Coodoo’s own flow rules and flow file (.coodoo/flow.json, only on the flow's first branch) on GitHub when you ask, turning on and updating your website on GitHub Pages (only how it is built and from which branch, plus Coodoo’s own build file on the first branch), switching Dependabot alerts and security updates on (never off), updating your settings and the encrypted shared vault in your own private repository coodoo-settings (only Coodoo's own files, and for the repository itself only: making it private again), and creating a release from the Release page. Every other write action on GitHub is refused. A file that is already in a release is never replaced
Never rewrite pushed history	No force push and no push that deletes a branch or tag on GitHub. Exceptions: Coodoo cleans up its own coodoo/ branches when they are fully contained in another branch, and you can delete a branch yourself on the GitHub page. Never main, master or the default branch
No destructive git commands	Never git reset --hard, git clean, filter-branch, branch -D or tag -d, and no removing remotes
No committing mass deletions	If an agent deletes many files at once, Coodoo puts them back and stops the goal instead of committing the deletion
Agents can't use your GitHub login	Claude Code and Codex get no token, no git credentials and no gh login. Only Coodoo itself talks to GitHub
Never commit or push a key	If a commit contains a key from the project vault, an MCP secret or your GitHub token (even encrypted or encoded), Coodoo doesn't commit or push anything
Vault values stay in Coodoo	Keys from the Project vault never show up again in a window, an instruction to an agent or a log; wherever they would appear, it says REDACTED
Work follows the project's flow	When a project has a flow, Coodoo only pushes to the first branch. A later branch only gets work from the branch before it (with Promote), or from the branch after it (with Back-merge)
At Cloudflare, only Coodoo’s own records	With your Cloudflare account, Coodoo only makes a tunnel per project, sets it up and puts a DNS record on it. It only ever removes DNS records it made itself: with Coodoo’s label, on Coodoo’s own list and pointing to that project’s tunnel. Your other DNS records and tunnels are never touched
Local folder only to the trash	Deleting a project never removes anything from GitHub. The local folder only goes to the trash, and only when all the work is on GitHub

On top of that, the agents work in a sandbox: they can only write in your project's folder. You'll see this under Autopilot settings → Sandboxing. On Windows this sandbox for Claude Code's commands does not exist (Claude Code cannot do that there); the other limits and all the failsafes above still apply.

When a failsafe steps in

• You get a Coodoo-failsafe notification saying what was blocked.
• The action shows up in the Blocked actions list under Settings → Failsafes.
• The agent is told it isn't allowed and looks for another way.

Note: A failsafe that steps in often can mean a goal asks for something that can't be done safely. Read the goal again.