Coldbrew lets a model request local filesystem reads and edits. Treat new capabilities carefully.

Security fixes are accepted for the current main branch.

Please open a private security advisory if the repository host supports it. If not, contact the maintainer privately before posting exploit details in a public issue.

Include:

• affected version or commit
• reproduction steps
• expected and actual behavior
• impact and suggested fix, if known

• Tools are scoped to projectRoot.
• Path escapes are rejected.
• Reads have a size limit.
• Binary-looking files are rejected.
• Write/edit/patch tools are enabled by default.
• Use --dry-run or :dry-run to preview write/edit/patch tools without changing files.
• Arbitrary shell command execution is not available. run_command supports only a small hardcoded verification allowlist.

These controls reduce risk but do not make this a full sandbox.

Do not expand command execution, shell execution, network mutation tools, destructive file operations, or credential-reading tools without:

• explicit approval gates
• tests for denied and allowed paths
• documentation of risk
• clear default-off behavior