Hand an agent a repository and a credential, and still be able to answer — afterwards, from records that can't be rewritten — exactly what it did and why it was allowed to. Everything below is implemented in the open; the security model and the threat model ↗ carry the detail.
The sandbox's model key is its session token — the facade swaps in the real credential upstream. Git fetches happen before the agent exists. Brokered tools execute control-plane-side against credentials sealed at rest with authenticated, tenant-bound envelope encryption.
Budget → frozen tool surface → argument schema → trust tier → policy → approval, identically for sandbox and brokered tools. There is no bypass mode; autonomous runs rewrite ask-a-human to the policy fallback and record both verdicts.
RunSpecs freeze at creation; agents and policies are append-only; the ledger accepts only redacted events by construction, with gapless per-run sequence numbers — a gap is evidence, not noise.
Sandboxes run with no network egress — Docker locally, admission-gated deny-all NetworkPolicies on Kubernetes. The control plane's own egress rides one hardened boundary: private/link-local/metadata address classes blocked at every dial site, credential-bearing clients refusing redirects outright.
Hosted mode adds per-org OIDC, server-side sessions, and RBAC — with tenant isolation enforced twice: as a type-level signature requirement in the data layer, and as forced PostgreSQL row-level security underneath it.
Pre-1.0. Implemented and tested — unit suites plus end-to-end acceptance driving real sandboxes, approvals, and OAuth — but no compliance certifications and no formal third-party audit yet. Residual risks are documented in the threat model, not rounded away.
Please don't open a public issue.Use GitHub's private vulnerability reporting, which opens a private thread with the maintainer, or email with [fluidbox security] in the subject (address in SECURITY.md). You can expect an acknowledgement within 72 hours and an assessment within a week — and credit in the advisory and changelog unless you prefer otherwise.
Highest-interest reports: sandbox escape or egress, credential exposure, policy or approval bypass, audit-trail integrity, ingress authentication, and budget bypass. fluidbox is pre-1.0: the latest main receives fixes.