Cathead Coding is currently a developer preview. Security fixes are applied to the latest release only.

Do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting with a description, reproduction, affected versions, and any known mitigation. Allow a reasonable remediation window before public disclosure.

The default DSH composition uses workspace-write: file mutations are confined to the selected workspace and platform temporary directories. Network access and process visibility are not restricted. The model can run commands and modify files inside that boundary, so use a version-controlled workspace and review changes before committing them.

Background commands inherit the same workspace-write sandbox and approval policy as foreground commands. They are tracked by id in the session and are stopped with the runtime; enabling background execution does not widen filesystem access.

API keys remain in the process environment and are passed to the owned DSH subprocess. Cathead Coding does not persist credentials in its configuration or session log.

Session search maintains a local derived SQLite index below ~/.cathead by default. It can contain snippets from local transcripts and should be protected with the same care as the session directory.