Please do not report security issues through public GitHub issues.

Report them through GitHub's Security Advisory "Report a Vulnerability" tab. You'll get a response indicating the next steps, and we'll keep you informed of progress toward a fix.

We appreciate responsible disclosure and will make every effort to acknowledge your contribution.

CleanSlate is an AI code editor that runs locally. The agent has access to powerful tools: shell execution, file reads and writes, browser automation, and network access.

CleanSlate does not sandbox the agent. There are safeguards, and they are real, but they are correctness and awareness features rather than a security boundary:

• Plan mode removes mutation tools and execute_command from the tool list and blocks them again at the call site. These restrictions are not an isolation boundary.
• Command approval — execute_command requests user approval before running, and a declined command returns as cancelled.
• Shell-edit blocking — source edits attempted through shell redirection, sed -i, or heredocs are refused and redirected to the edit tools.

In execution mode, an approved command runs with your full user privileges. If you need true isolation, run CleanSlate against a workspace inside a container or VM.

• Credential storage depends on the host. The CLI stores credentials in ~/.cleanslate/auth.json and sets owner-only file permissions; SDK hosts manage their own storage.
• The editor includes a local embedding model. Hosts can also configure remote embedding services, which receive the content being embedded. Check your host's configuration before indexing sensitive code.
• Prompts and file context you send to a provider are governed by that provider's policies.

Prompt injection through file contents, web pages, or tool output that causes the agent to take an action is in scope — tell us about it.