WBZ v0.1 is an experimental local control plane. It is not a hardened sandbox for hostile repositories or arbitrary untrusted code.

Security fixes currently target the latest commit on the default branch.

Do not include exploitable details, secrets, personal data, or private repository content in a public issue. Use GitHub's private vulnerability reporting feature for yubnsbski/wbz when available. If private reporting is unavailable, open a public issue containing only a request for a private contact channel.

Include:

• affected version or commit;
• minimal reproduction without secrets;
• expected and observed security boundary;
• impact and preconditions;
• suggested mitigation, if known.

• Work occurs in an isolated Git worktree.
• The runtime does not push, open PRs, merge, deploy, or access secrets.
• Codex review uses read-only mode; builders use bounded workspace access.
• High-risk paths and permission expansion require human attention.
• Model capacity and authentication failures stop or defer work.
• The dashboard binds to loopback and rejects external origins, cross-site writes, non-JSON writes, and non-loopback Host headers.
• Every state transition and risk decision is recorded in SQLite.

Git worktrees, model sandboxes, and localhost binding are defense layers, not complete security isolation. Run WBZ only on repositories and test commands you trust.