regatta spawns AI agents that execute shell commands inside your git worktrees. Treat any instance of regatta you run as a process that has all the privileges of the user running it.

regatta is a local development tool. It is not a sandbox.

• Plan files (plans/*.yaml) are code. A plan author can prescribe arbitrary prompts, repos, and commands. Only load plans you trust.
• Prompts are sent to a third-party model by whichever provider CLI you've configured (codex, claude, etc.). Anything you put into a task description leaves your machine. Don't run regatta against a private repo if your provider relationship doesn't allow it.
• The Discord bridge is a remote control surface. Anyone able to post in the configured channel can spawn or retask workers. Always set DISCORD_CHANNEL_ID, and set DISCORD_ALLOWED_USER_IDS to lock control to specific accounts.
• Worker output is persisted in .regatta/runs/<run-id>/. Treat that directory as sensitive — it contains task prompts, transcripts, and any secrets the agents happened to surface.

• Every subprocess.run is list-form. No untrusted strings are concatenated into a shell command.
• shlex.quote/shlex.join are used wherever a shell string is unavoidable (tmux send-keys, worker scripts).
• Secrets are accepted from environment variables only, never via argv.
• .regatta/ is gitignored so worker transcripts don't leak into commits.

Please do not open a public GitHub issue for security reports.

Email: swidlundstone@gmail.com with subject regatta security.

Include:

1. A description of the vulnerability and its impact.
2. Steps to reproduce.
3. Affected version (regatta --version if relevant) and platform.

I'll acknowledge within a week and aim to ship a fix or a documented mitigation within two weeks.

Coordinated. I'll credit you in the release notes unless you ask otherwise.