# Security

## Reporting a vulnerability

Please **do not** open a public issue for security vulnerabilities. Instead,
use [GitHub's private vulnerability reporting](https://github.com/ablate-dev/ablate/security/advisories/new)
for this repository.

## Scope and known limitations

`ablate` runs a coding agent with write access inside a `git worktree` of
your repository. Worktrees give filesystem isolation for the directory the
agent operates in — they do **not** isolate:

- the network (an agent can make arbitrary outbound requests),
- installed system packages or global tool state,
- anything outside the worktree, including `$HOME`, if the agent is
  instructed or manipulated into reaching for it.

This is a documented v1 limitation, not a bug to report. If you need
stronger isolation, run `ablate` itself inside a container or VM. See
`docs/03-architecture.md` for the full isolation model.

Trials run with `ANTHROPIC_API_KEY` (or the equivalent for other adapters)
in the environment. Treat `.ablate/runs/*/trials.jsonl` and
`.ablate/runs/*/traces/` as containing whatever the agent's prompts and
outputs contained — review before sharing publicly.
