Sandbox and secrets

The sandbox

Commands the agent runs on your computer run in a sandbox:

• on macOS, with the system's own sandbox-exec;
• on Linux, with bubblewrap (bwrap), where it is installed and the kernel allows it.

Inside it, a command can write only in the folder, the temp folder and package caches, and it can't read ~/.ssh, ~/.aws or ~/.gnupg. Your sign-ins (~/.config/gh, ~/.docker, ~/.npmrc and the like) and the folder's secret files are kept out unless you said yes to that very command.

Without a working sandbox, a command runs with your own permissions, so it asks every time, unless a rule allows it, and Workspace free can't be chosen.

.env files

A dev server in a folder with a .env asks first, and a command that failed because it couldn't read one asks after: once, always for this folder (the rule secrets: .env), or no.

Docker

Docker runs only as a few commands (docker compose up -d, down, ps, logs, docker info), alone, and always asks unless a rule or Fully free allows it. Before up, the compose file is checked.

Ubuntu 24.04

Ubuntu 24.04 restricts the unprivileged user namespaces bwrap needs, so the CLI treats the machine as having no sandbox until you allow it. Install bubblewrap and give it its own AppArmor profile (the narrower option); the CLI's help explains both ways. bwrap --ro-bind / / true exiting 0 means it works.

Secret scanning

One detector keeps credentials out of everything the agent writes or publishes: file writes and edits, commands, deployed projects, agent and skill drafts, automation specs, remote previews, pages, notes, automation inputs and assistant instructions. It finds key shapes, secret-named assignments with real values and URLs with passwords, and lets through placeholders, local development defaults, docs and tests.

A refusal names the file, the line and the environment variable to read the value from, never the value. The agent then writes the code again to read it from the environment.

Secrets in the chat

A message that looks like a token is kept away from the agent and stored only in a redacted form. Set your Enterprise Action Token with crewdesk token set, never in the chat.

Files that never leave

When a folder is packed (for a remote preview or a deploy), .env files, keys, dependency and build folders and what .gitignore leaves out stay behind. A push is refused if a commit adds or changes a secret file.