Security

Security

CodingDude runs an agent with your permissions on your machine. The posture is: loopback only, everything authenticated, risky actions gated, and every claim about safety written down with its limit.

The ADR is docs/adr/; the summary below is what is implemented.

Implemented

• Loopback bind. 127.0.0.1 only — the server is not reachable from the network, whatever the port.
• Token auth on everything except /health. The token lives in ~/.codingdude/server-token, is stable across restarts, and is accepted as a Bearer header, a session cookie, or ?token= for EventSource streams.
• Passwordless browser login with attestation. POST /auth/local checks same-origin (Sec-Fetch-Site), a Host allowlist and the origin before issuing a cookie. Any non-browser client must present the token.
• Tiered approvals with an always-gated core. Pushes, PR creation, releases, package installs and destructive filesystem operations are never pattern-unlockable. Pattern approvals are session-scoped only.
• Budget cap independent of --yolo. Spend stops are not an approval question.
• Environment scrubbing. Subprocesses run with KEY/TOKEN/SECRET/ PASSWORD/CREDENTIAL variables removed, so an approved command cannot exfiltrate a provider key. Secrets are masked in every config read path — the API reports presence, never values.
• Workdir containment. All file tooling resolves paths through one containment helper; the editor, render and file endpoints use the same one. Path escapes are rejected.
• Security gate, fails closed. Bandit, Semgrep and secret regexes run over candidate code; a finding blocks rather than warns.
• The git directory is off limits. File tools refuse paths inside .git, so the review record cannot be fabricated by writing a file.

Honest limits

These are stated in the project's own documentation, and they are real:

• The shell tier check is a heuristic, not a sandbox. An approved command runs with full user permissions. Tiering decides what to ask you about; it does not contain what you approve.
• Approval fatigue is a vulnerability. --yolo and Approve pattern exist because gates are noisy; they also remove the gate. Use them for scripting, not as a habit.
• The review gate proves a review was recorded, not that it was competent. An agent can record a review it did not perform.
• The shell push refusal is a pattern match. A script invoked by name that pushes internally is not caught.
• Web fetch permits localhost probing — deliberately, because local docs and tests are legitimate targets, but it means an agent's fetch is not a network boundary.
• Prototype sandboxes exist but are not the default. sandbox.py offers a container tier (docker run + python:3.12-alpine, with worktree+venv fallback), and long-run lanes use it; ordinary approved shell commands are not run inside a sandbox.
• Deferred: job-object isolation for the shell tool, per-command environment allowlists.

Responsibilities that stay yours

You own	Because
which provider sees your code	a provider key means prompts leave the machine
the always-on host	this is a single-user tool, not a multi-tenant service
the approval you click	tiering is a prompt, not a proof
your own commits and pushes	the gate checks a record exists, not that the code is good

Reporting a vulnerability

Do not open a public issue. Follow SECURITY.md. Setup and configuration questions belong on Discord.

Generated code

Code, documents and other artifacts generated by CodingDude for you belong entirely to you. AGPL obligations apply to CodingDude's own source, not to what you build with it — unless you run a modified CodingDude as a network service, in which case AGPL §13 applies to that modified source.