Agent Trestle launches local AI agents that may read or modify repositories. The default policy is least privilege:

• unrestricted tools, filesystem paths, and URLs are disabled;
• non-interactive execution requires an explicit policy;
• the CLI refuses to merge by default: review --merge additionally requires permissions.autoMerge, an explicit ownership policy and actor, a passing exact-diff review, and a base ref that has not moved since approval;
• the dashboard binds only to 127.0.0.1;
• state and audit paths are constrained to configured project roots.

The full threat model and containment guarantees are documented in docs/security-model.md.

The project is pre-release and fixes land on the newest version only. There are no backports to earlier tags.

Report privately through GitHub Security Advisories:

https://github.com/trsdn/agent-trestle/security/advisories/new

The same form is reachable from the repository's Security tab via Report a vulnerability. Private vulnerability reporting is enabled, so the report stays visible only to you and the maintainer.

Do not open a public issue, pull request, or discussion for a suspected vulnerability, and please do not disclose details publicly until a fix or a documented mitigation is available.

Include, where you can:

• the affected release or commit, plus your OS and Node.js version;
• the relevant .trestle/config.json settings, with secrets and private paths redacted;
• reproduction steps or a proof of concept;
• the impact you expect, such as containment escape, audit tampering, review bypass, or credential exposure.

Reporters are credited in the advisory unless they ask not to be. This is a volunteer-maintained project, so these are targets rather than guarantees; if a report goes unanswered past these windows, please ping the advisory thread.

In scope: containment escapes from configured project roots, review-gate or audit-integrity bypasses, dashboard exposure beyond 127.0.0.1, privilege escalation past the documented permission defaults, and credential or state leakage in logs and audit records.

Out of scope: vulnerabilities in Node.js, Git, or the GitHub Copilot CLI themselves — report those to their maintainers — and behaviour that follows directly from an operator deliberately enabling a documented opt-in such as permissions.allowAllTools or permissions.autoMerge.

These are understood weaknesses rather than reportable findings. They are listed so operators can compensate, and each is a candidate for hardening.

• A custom reviewer definition is read from the working tree. --reviewer names an agent whose definition is loaded from the checkout as it exists when review runs, not from the reviewed base commit. An actor able to write that definition can therefore influence the reviewer that judges its own work, including through changes that were never committed or reviewed. Prefer a built-in reviewer, or keep agent definitions in a location the producing agent cannot write.
• An in-repository ownership policy is only protected against committed changes. A merge whose reviewed diff touches the ownership policy or .trestle/config.json is refused, but an uncommitted local edit made before review runs is not detected. Keep the policy outside the repository — see docs/merge-semantics.md.
• Auto-merge trusts the operator's .trestle/config.json. permissions.autoMerge is read from the project configuration, so anything that can write that file can enable merging. It is off by default and must also pass ownership and exact-diff checks, but the configuration file should be treated as a trusted input.