Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

RFC: Deterministic execution guardrails for unattended sessions (secrets + shared App tokens in sandbox)

Abierto
  • ¿Algo no está bien?
#1,663 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@shrwnsan ya está trabajando en esto.

Desde el 14/9/2026.

  • #1901 de @shrwnsan — abierto

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
32/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
github, typescript
Área
security

Línea de trabajo

Start with the README security model and the automations feature, then inspect sandbox-runtime; SECURITY.md describes where sensitive reports belong. The scope is not settled: maintainers must choose between a sandbox-runtime policy layer and sandbox-infrastructure networking. Done would be an accepted optional implementation with tests and documentation.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

The gap

The README's security model is refreshingly honest, but reading it against the automations feature, there's a gap I'd love maintainer thoughts on:

  • Secrets are decrypted and injected as env vars at spawn (encrypted at rest, plaintext in-sandbox).
  • The git credential helper brokers short-lived shared GitHub App installation tokens into the sandbox.
  • Automations (webhooks, Sentry alerts, cron) start sessions with no human in the loop, and inbound payload content reaches the agent as prompt context.

So a malicious webhook/Sentry/Linear payload = indirect prompt injection into a sandbox holding (a) decrypted org secrets and (b) git credentials valid for every repo the App is installed on — with port tunnels and browser automation as exfil channels.

The single-tenant trust assumption covers users, but not content arriving at users' agents.

Proposal (optional, default-off)

A deterministic pre-execution policy layer in sandbox-runtime:

  1. Secret denial — block command args/env reads targeting injected secrets + credential helper.
  2. Egress allowlist — fail-closed, subdomain-aware; curl/wget/tunnels restricted to known infra domains.
  3. Git remote allowlist — push/fetch only to configured SCM hosts.
  4. Per-session spend cap — including child-session fan-out.
  5. Signed block receipts — emitted to the session event stream for audit.

Shadow mode by default, hard blocks via flag. Zero behavior change when off.

Question for maintainers

Interest in this as an optional hardening layer? Happy to contribute the implementation (tests + docs included) if the direction is welcome — or open to pointers if you'd rather solve it at the sandbox-infra network level instead.

(Hardening proposal, not a vuln disclosure — anything sensitive routes via SECURITY.md.)

Lenguaje dominante
TypeScript
Estrellas
3.3k
Forks
477
Merge medio
20 h 5 min
PR fusionados (30 d)
290

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de ColeMurray/background-agents

Todos los issues de ColeMurray/background-agents

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.