Please open a GitHub issue (or contact the maintainers privately if the issue is sensitive) describing the vulnerability. Do not include API keys or secrets in issues.

• No secrets in config.json. The launcher never persists API keys, tokens or passwords in its main config file. Credentials are passed to the Pier subprocess and the sandbox container via environment variables (OPENAI_API_KEY, MSWEA_API_KEY, etc.).
• WebUI「添加模型」key handling. When you add a model through the WebUI wizard, the API key is written only into the generated configs/models/<name>.yaml (the mini-swe-agent model config — same pattern as the shipped configs/mini-swe-local.example.yaml), and the launcher injects it into the pier subprocess environment at run time so you do not need to export it manually. The WebUI/API never echo the key back — /api/state only reports whether a key is set (has_api_key). Keep the launcher directory on a trusted machine; treat configs/models/*.yaml as sensitive.
• Local-only web UI by default. The Web UI binds to 127.0.0.1. If you change server.host to expose it on a network, add your own authentication — the built-in UI has no auth.
• Optional Pier patch relaxes isolation. scripts/patch_pier.sh switches the agent container to host networking (needed on Docker hosts with bridge networking disabled). Only use it on trusted local machines.
• Sandboxed execution. Evaluations run inside Docker containers driven by Pier; the launcher itself only orchestrates subprocesses and reads outputs.

The repository itself must never contain real credentials, personal absolute paths (/home/<user>, /Users/<user>, /root/...), or runtime benchmark data:

• config.json and user model YAML files (configs/*.yaml, configs/models/*.yaml) are git-ignored. Only *.example.yaml / config.example.json templates are tracked and must keep placeholder values such as sk-local, https://api.openai.com/v1, <user>, <path>.

• state/, logs/, runs/, jobs/, reports/, bin/, pier-patch/ are runtime outputs and are git-ignored. They may contain task results, container output and absolute paths; clean them before sharing a workspace snapshot.

• Before every commit, run:

  bash scripts/check_secrets.sh        # check tracked files
  bash scripts/check_secrets.sh --all  # also check runtime outputs in worktree

• If --all reports runtime files (they are not part of the repository content), remove or redact those files; do not add them to git.