Security

An agent that works on your machine,
on your terms

Agent V can run commands, edit files, commit and drive a browser. These are the controls that decide what it does without asking, and their limits.

You choose what asks first

At setup you pick "Edits and commands", "Every tool" or "Unattended", which turns approvals off. You can change it per workspace. With "Edits and commands", reading and searching run freely and anything that changes files or runs code asks.

Some tools always ask

Tools from MCP servers (unless you turn that setting off), tools the agent wrote itself and risky commands ask before they run, even when approvals are off. The "Unattended mode" switch in Settings, Agent approves the rest on its own but still asks before edits, deletes, terminal commands, commits, pull requests, MCP tools and other high-risk tools.

Approvals are narrow

Allow once, allow for this task, or always allow one tool or command in this workspace. A command that chains or redirects is never offered "Always allow". A risky command is only offered Allow once or Deny. A request nobody answers is denied after 15 minutes.

Work happens on a branch

A task can run in its own git worktree. An instance that writes gets its own branch when a worktree can be made; otherwise it must be limited to folders, and it cannot write outside them.

File edits can be undone

Each file the agent edits is checkpointed with a hash of what it wrote. Rewinding puts files back and leaves alone any file you changed since. A file changed by a terminal command may have no copy to go back to.

Ask mode reads

In Ask mode the agent gets read-only tools: it can read, search and answer, not edit files or run commands. By default it can switch itself to Agent mode when a task needs changes. Turn off "Switch between Ask and Agent on its own" in Settings, Agent to keep it in Ask.

Keys stay encrypted

API keys are encrypted with your operating system's secure storage and never written in plain text. Shells the agent starts get an environment with your API keys and tokens removed.

The browser is fenced

In Ask mode the built-in browser cannot reach private or loopback addresses. In Agent mode it can, so it can test your local server. You can limit it to a list of domains. Remote MCP servers are refused on private addresses too. None of this covers terminal commands or local MCP servers.

What it does not do

Agent-built tools are not sandboxed. A tool the agent writes runs with full Node.js access in its own process, with a 30-second limit. That is why it asks before every run, and why an "Always allow" is tied to the exact contents of the file: change the file and it asks again.

Nothing is forbidden outright. A short list of destructive commands, such as recursive deletes outside the workspace, force pushes, git reset --hard, git clean -f, disk formatting and downloads piped into a shell, always asks, in every mode. It reads the command text, so it can miss what a script does. Everything else follows your approval setting. Keep "Edits and commands" on for work you are not watching.

Security Policy

Supported versions

Security fixes are provided for the latest release on the main branch and the most recent tagged release.

Version	Supported
latest tagged release	yes
`main`	yes
older tags	no

Reporting a vulnerability

Do not open a public GitHub issue for security vulnerabilities.

Use one of these channels:

GitHub private vulnerability reporting — Report a vulnerability on this repository (preferred).
Email — security@vyotiq.com (if private reporting is unavailable).

Include:

Description of the issue and impact
Steps to reproduce
Affected versions or commits
Proof of concept, if available

We aim to acknowledge reports within 3 business days and will coordinate disclosure after a fix is available.

Secure development

API keys are stored with Electron safeStorage; never commit secrets.
Packaged builds flip Electron fuses: the app ignores the --inspect switches, loads its code only from app.asar, and on Windows and macOS checks that file against a hash embedded in the executable. The executable also refuses to run as plain Node (ELECTRON_RUN_AS_NODE) and ignores NODE_OPTIONS. Since that also drops NODE_EXTRA_CA_CERTS, the app itself adds the operating system’s certificate store and the file NODE_EXTRA_CA_CERTS names (on Windows, read back from the user or machine environment) to the certificates its own network calls trust. The hash check covers app.asar only, not the unpacked native modules beside it, and Chromium switches such as --remote-debugging-port still work, so anyone who can run the binary with arguments of their choosing can still drive it.
CI runs pnpm audit --audit-level high on every change.
Secret scanning and push protection are enabled on this repository.
Dependabot security updates are enabled.

Security updates

Subscribe to GitHub Releases for patched builds.

This section is SECURITY.md from the public repository.