Security & Sandboxing
Relevant source files
The following files were used as context for generating this wiki page:
Rebase implements a security model centered on local execution, authenticated remote access, and content sanitization. The system treats coding agent sessions with the same level of trust as a terminal user. It relies on the underlying permissions of the installed agent CLIs and the operating system to govern file modifications and command execution.
Local Execution and Agent Trust
Rebase runs agent CLIs that are already installed and authenticated on your machine. A session possesses the authority to edit files and run commands exactly as those tools would in a terminal. Users must treat agent prompts with the same caution as running manual commands in a terminal.
Sources: SECURITY.md:7-9
Automation and Scanning
The project includes predefined automation templates specifically for security tasks. These templates automate the detection of vulnerabilities and secrets within the codebase.
| Template ID | Purpose | Focus Areas |
|---|---|---|
scan-vulnerabilities | Weekly security review | Injection, XSS, SSRF, Auth bypass, Unsafe deserialization |
dependency-audit | Audit lockfiles | Vulnerable or abandoned packages |
secret-scan | Search history/tree | API keys, tokens, private keys, credentials |
Sources: src/features/automations/model/automationTemplates.ts:74-95, src/features/automations/model/automationTemplates.ts:153-192
Remote Host Security
Rebase supports remote sessions via an RPC server. This server enforces strict authentication and authorization to prevent unauthorized access to host resources.
Authentication and Revocation
Remote access requires an authentication token. The server validates tokens for every request and can revoke access immediately, even while a request body is still arriving.
The diagram shows the synchronous authentication check performed by the Host Server against the Host Store for every RPC call.
Sources: host/server.test.ts:47-75, host/server.test.ts:114-131
Path Traversal Prevention
The host server protects against directory traversal and symlink escapes. It restricts file operations (read/write/list) to the identified project root and authorized worktrees. Attempts to access paths outside these boundaries result in errors.
Sources: host/server.test.ts:400-435, host/server.test.ts:586-598
Content Sanitization and UI Sandboxing
Rebase uses a hardened rendering pipeline for Markdown and HTML content generated by agents.
HTML Artifacts
When an agent generates visual content using artifacts.write with kind: "html", Rebase renders the content in a sandboxed frame.
- Isolation: The page cannot fetch external data.
- Resource Loading: Scripts, styles, and images must load from public HTTPS CDNs or be embedded inline.
- Theme Integration: The page accesses the app's light/dark mode through CSS variables (e.g.,
--background,--accent).
Sources: src/features/pilots/model/pilotFiles.ts:251-251
Markdown Hardening
The AgentMarkdown component uses rehype-harden to enforce security policies on rendered text.
- URL Filtering: It blocks executable URL schemes like
javascript:anddata:(except for images). - Network Isolation: It prevents "magic" links from turning network paths (e.g., UNC paths or encoded host shares) into local file links.
- Protocol Restriction: Only specific protocols like
https:are permitted for external links.
Sources: src/features/sessions/ui/AgentMarkdown.tsx:84-93, src/features/sessions/ui/AgentMarkdownFileLinks.test.ts:167-178
Redaction and Secrets
The system explicitly instructs agents to avoid saving secrets, tokens, or credentials in memory. The SOUL.md and MEMORY.md files are intended for facts and instructions, and secrets are subject to redaction.
Sources: src/features/pilots/model/pilotFiles.ts:254-254
Workspace Path Validation
The application validates file references to ensure they resolve correctly within the workspace without exposing the local filesystem to untrusted inputs.
This flowchart illustrates the logic used to resolve and validate file paths and links within the Rebase workspace.
Sources: src/shared/lib/paths.test.ts:38-124
Summary
Security in Rebase is built on the principle of least privilege for remote access and strict sanitization for agent-generated content. By sandboxing HTML artifacts and hardening Markdown rendering, the system prevents common attack vectors like Cross-Site Scripting (XSS) and unauthorized filesystem access via malicious prompts.
Sources: SECURITY.md:7-9, src/features/pilots/model/pilotFiles.ts:251-251