How Lanes bounds autonomous agents.

No writes to your default branch

Agents never push. Only the platform pushes, and only to a work branch.

• Code leaves the sandbox as a bundle that the platform validates before it pushes.
• Every change reaches your default branch through a pull request that a human merges.
• Sandbox tokens carry no workflows permission, so an agent cannot alter your CI configuration through the token.

Read-only credentials in sandboxes

A sandbox can read code. It cannot push.

• With the GitHub App, a sandbox gets short-lived, read-only installation tokens.
• In personal-account mode it gets the read-only token you configured, after the platform has checked that it cannot write. That token lives as long as you set it to and can read every repository it covers, so scope it narrowly.
• Production and write credentials are kept out of sandboxes.
• The one exception is a direct model provider key, either the platform's or your own, which is injected into the agent's environment under reserved-name and metering rules.

Gates the agent cannot fake

Checks are executed by the platform and their results are recorded by the platform.

• An item cannot reach review while a required check is failing.
• Fix loops are bounded by the lane's escalation policy.

An independent reviewer

The reviewer works from evidence, not from the implementer's account.

• It receives the task, the diff, the check results and earlier findings.
• It never receives the implementer's history or reasoning.

Agent output is untrusted

Whatever comes out of a sandbox is treated as input from an outsider.

• Output read from a sandbox is bounded in size and validated.
• It is never interpolated into a shell command.

Secrets by reference

Configuration carries references to secrets, not the secrets.

• Agent profiles, environments and workflow payloads hold references only.
• Values are resolved at the point of use, inside the platform's own activities or its tool gateway.
• Harness configuration is materialized outside the repository tree, and configuration shipped inside a repository is ignored.

Tenant isolation and human control

Your data is scoped to your organization, and you can stop any run.

• Every tenant-owned record belongs to an organization and every query is scoped to it.
• You can pause a run at any time, inspect or take over the sandbox, and resume.
• Projects, lanes and finished work items can be deleted for real, including their sandboxes.

Report a vulnerability

If you believe you have found a security issue in Lanes or on this website, please email [email protected].

Please include:

• A description of the issue and its impact.
• Steps to reproduce, or a proof of concept.
• The affected URL, component or version, if you know it.
• How you would like to be credited, if at all.

What to expect:

• I acknowledge reports within 3 business days.
• Please practice coordinated disclosure: give me a reasonable time to fix the issue before you publish details.
• Good-faith research is welcome. If you stay within this policy, avoid privacy violations and data destruction, and only touch accounts and data you own, I will not take legal action against you.
• Out of scope: denial-of-service testing, social engineering, spam, and findings without a demonstrable security impact.
• There is no bug bounty yet.

Contact: [email protected]. Machine-readable: security.txt.