What Crewline can and can't see

Where data lives

The eight layers

1. A sandbox per task

Each run gets a fresh GitHub-hosted VM that is destroyed afterwards, with only the repo checked out. Outbound traffic is blocked except GitHub, the model API, package registries and Crewline.

2. Two jobs: the agent can't push

The agent job runs the coding agent with a read-only token and an environment scrubbed of all GitHub tokens. It hands over a patch. The publish job runs no agent and no repo code. It re-checks the patch (no .github/ changes, no submodules, no symlinks out of the repo, size limits), then pushes to the agent's own crew/<persona>/<issue> branch and opens a PR.

3. Humans merge

Agents never merge. Branch protection on the default branch and CODEOWNERS on .github/ keep CI and main safe.

4. Verified identity

Telegram users verify their GitHub account through GitHub's device flow, in a private chat only. Roles come from GitHub: admin or maintain = maintainer, write = member, everyone else is ignored. Plans need a maintainer's approval before any code is written.

5. Untrusted text is data

Issue bodies, comments and file contents are fenced with a random marker, and agents are told never to follow instructions inside them. We assume prompt injection can still happen, so the other layers limit what a hijacked agent can do: write to its own branch, in a throwaway VM, for one run.

6. Short-lived everything

Runner calls use GitHub OIDC tokens bound to the repo and the workflow run. Proxy tokens are per run, carry a dollar budget, and are revoked by /stop. GitHub user tokens from /link are used once and not stored.

7. Kill switch and audit log

/stop all cancels every workflow run and revokes proxy tokens. Uninstalling the GitHub App cuts all access immediately. Every action is in the audit log, exportable with /audit.

8. Open source

Every component is open source and self-hostable, so you can verify these claims instead of trusting them.

Bounty funds

Funds sit in the BountyEscrow contract, never with Crewline. Crewline can only confirm a merge, with M-of-N signatures. The funder has a 48-hour window to freeze a payout, and nobody (including Crewline and the contract owner) can send escrowed funds to an arbitrary address. Only hashes go on-chain, never repo names or issue text.

Known limits

We'd rather you hear these from us.

• Prompt injection isn't solved. A malicious issue or file can still steer an agent. The damage is limited to one branch in one throwaway VM and a human must merge, but reviewers must actually read the diff.
• Telegram groups aren't end-to-end encrypted. Crewline only posts summaries, file paths and links there, never code. Task text you type in the group is visible to Telegram.
• Secret key mode puts the model key in the agent job. A hijacked agent with root on the runner could read it. Proxy mode keeps keys out of the sandbox; then prompts pass through the proxy in transit.
• Subscription mode works like secret mode: your plan login is in the agent job for that run. Only your own persona uses it, for tasks you create.
• The egress allowlist uses some wildcards for GitHub's artifact storage and user content domains.
• The agent job holds an OIDC request token. It can only mint tokens for its own run, so the worst case is fake status messages for its own task.
• Proxy budgets can overshoot by the cost of requests already in flight.
• Bounty attester keys are held by the coordinator in this version, which is fine for testnet. Mainnet needs hardware-backed keys and independent attesters. The funder together with the guardian multisig could deny a legitimate solver.
• Roles are cached for 10 minutes. Removing someone's GitHub access takes up to 10 minutes to apply in chat.
• No external audit yet of the contracts or the server. It is planned before mainnet.

Reporting a vulnerability

Please report security issues privately to our security contact rather than in a public issue. We'll credit you once it's fixed.