repogym executes code from task repositories and from agents. Treat every task you did not author as untrusted.

• Use DockerSandbox for anything untrusted: it runs each command in a fresh container with the network disabled and CPU/memory limits.
• LocalSandbox is a convenience for your own tasks. It scrubs the environment to an allowlist (no API keys leak into agent commands) and the environment's run action is restricted to allowlisted executables, but it is not a security boundary: a task's repo.setup or test command runs with your user's privileges.
• ShellAgent intentionally inherits your full environment so external agent CLIs can authenticate. Only point it at tools you trust.

To report a vulnerability, open a GitHub security advisory on the repository or contact the maintainer privately. Please do not file public issues for exploitable problems.