Catálogo de contracts¶
Corpus v1.1: 196 contracts en 9 categorías. Cada uno nombra el test público que
re-expresa (source). El formato está en la referencia.
| categoría | contracts |
|---|---|
| credentials | 12 |
| filesystem | 52 |
| ipc | 6 |
| isolation | 23 |
| lifecycle | 5 |
| network | 17 |
| resources | 1 |
| secrets | 60 |
| trust-handoff | 20 |
credentials¶
| contract | severidad | os | source |
|---|---|---|---|
credentials-broker-auth-required |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/update-config.test.ts (Apache-2.0) |
credentials-broker-injected-header-not-overridable |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/request-rewriting.test.ts (Apache-2.0) |
credentials-broker-method-denied |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/proxy-only-methods.test.ts (Apache-2.0) |
credentials-broker-no-redirect-follow |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/credential-mask.test.ts (Apache-2.0) |
credentials-broker-prefix-scope |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/proxy-only.test.ts (Apache-2.0) |
credentials-broker-token-not-forwarded |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/credential-mask.test.ts (Apache-2.0) |
credentials-masked-env-agent-holds-sentinel |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/credential-mask.test.ts (Apache-2.0) |
credentials-masked-env-body-scoped |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/credential-mask-env.test.ts (Apache-2.0) |
credentials-masked-env-no-laundering |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/credential-mask.test.ts (Apache-2.0) |
credentials-masked-env-not-in-process-records |
high | linux | anthropics/sandbox-runtime test/sandbox/credential-mask.test.ts (Apache-2.0) |
credentials-masked-env-not-sent-to-other-host |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/credential-mask.test.ts (Apache-2.0) |
credentials-masked-env-plain-http-not-swapped |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/credential-mask.test.ts (Apache-2.0) |
filesystem¶
| contract | severidad | os | source |
|---|---|---|---|
filesystem-chmod-outside |
high | linux, macos | nolabs-ai/nono tests/integration/test_commands.sh ("chmod blocked by default"; nono blocks the argv, we test the syscall) (Apache-2.0) |
filesystem-command-cwd-not-writable |
high | linux, macos | openai/codex codex-rs/exec/tests/suite/sandbox.rs::sandbox_distinguishes_command_and_policy_cwds (Apache-2.0) |
filesystem-deny-ancestor-rename |
critical | linux, macos | openai/codex codex-rs/exec/tests/suite/seatbelt.rs::seatbelt_blocks_renaming_ancestors_of_explicit_protected_files (Apache-2.0) |
filesystem-rename-into-territory |
critical | linux, macos | nolabs-ai/nono crates/nono-cli/tests/execution_strategy_run.rs (Landlock Refer rename) (Apache-2.0) |
filesystem-rename-out-of-territory |
critical | linux, macos | nolabs-ai/nono crates/nono-cli/tests/execution_strategy_run.rs (same-FS rename / Landlock Refer, #1689) (Apache-2.0) |
filesystem-rm-under-read-deny-ancestor-by-omission |
medium | linux, macos | anthropics/sandbox-runtime test/sandbox/allow-read.test.ts (Apache-2.0) |
filesystem-rm-under-read-deny-ancestor |
medium | linux, macos | anthropics/sandbox-runtime test/sandbox/allow-read.test.ts (Apache-2.0) |
filesystem-single-file-grant |
high | linux, macos | nolabs-ai/nono tests/integration/test_child_tool_boundaries.sh ("session sandbox writes granted single file") (Apache-2.0) |
filesystem-tmp-shm-not-shared |
medium | linux | openai/codex codex-rs/linux-sandbox/tests/suite/sandbox.rs::bwrap_preserves_writable_dev_shm_bind_mount (grant-only) and containers/bubblewrap tests/test-sandbox.py::test_ro_bind_root_is_recursive (idea only, LGPL-2.1-or-later) |
filesystem-truncate-outside |
critical | linux, macos | nolabs-ai/nono tests/integration/test_system_paths.sh ("cannot write to ...") (Apache-2.0) |
filesystem-unlink-outside |
critical | linux, macos | nolabs-ai/nono tests/integration/test_profiles.sh ("default profile blocks rm outside granted area") (Apache-2.0) |
filesystem-utime-outside |
medium | linux, macos | nolabs-ai/nono tests/integration/test_commands.sh (destructive metadata ops) (Apache-2.0) |
filesystem-writable-root-move-across-roots |
high | linux, macos | openai/codex codex-rs/exec/tests/suite/seatbelt.rs::seatbelt_blocks_renaming_protected_workspace_into_another_writable_root (Apache-2.0) |
filesystem-writable-root-replace |
high | linux, macos | openai/codex codex-rs/sandboxing/src/seatbelt_tests.rs::seatbelt_prevents_writable_root_replacement and ::seatbelt_prevents_writable_directory_root_rename (Apache-2.0) |
filesystem-write-deny-absent-path |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/deny-path-made-meanwhile.test.ts (Apache-2.0) |
filesystem-write-deny-rename-bypass |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/macos-seatbelt.test.ts (Apache-2.0) |
filesystem-write-deny-survives-recursive-remove |
high | linux, macos | denoland/deno tests/specs/permission/read_partial_ancestor_of_deny (recursive_remove_blocked_by_denied_descendant) (MIT) |
filesystem-write-deny-symlink-alias |
critical | linux, macos | openai/codex codex-rs/exec/tests/suite/seatbelt.rs::seatbelt_blocks_protected_reads_and_writes_through_symlink_aliases (Apache-2.0) |
filesystem-write-deny-truncate-unlink |
critical | linux, macos | openai/codex codex-rs/exec/tests/suite/seatbelt.rs::seatbelt_deny_globs_block_writes_to_existing_and_new_files (Apache-2.0) |
filesystem-write-deny-unlink-recreate |
critical | linux, macos | nolabs-ai/nono crates/nono-cli/tests/glob_deny_after_start_run.rs (deleted_and_recreated_file_stays_denied) (Apache-2.0) |
filesystem-write-deny-via-symlink-spelling |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/deny-order-independence.test.ts, test/sandbox/read-deny-glob.test.ts (Apache-2.0) |
filesystem-write-reallow-inside-deny-by-omission |
medium | linux, macos | openai/codex codex-rs/linux-sandbox/tests/suite/sandbox.rs::sandbox_reenables_writable_subpaths_under_unreadable_parents (Apache-2.0) |
filesystem-write-reallow-inside-deny |
medium | linux, macos | openai/codex codex-rs/linux-sandbox/tests/suite/sandbox.rs::sandbox_reenables_writable_subpaths_under_unreadable_parents (Apache-2.0) |
filesystem-write-system-paths |
critical | linux, macos | nolabs-ai/nono tests/integration/test_system_paths.sh ("cannot write to /usr/bin, /etc, /usr/lib, /lib, /System/Library, /Library") (Apache-2.0) |
filesystem-xattr-outside |
medium | linux, macos | nolabs-ai/nono tests/integration/test_commands.sh (destructive metadata ops) (Apache-2.0) |
fs-dangling-symlink-create-outside |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/integration.test.ts (Apache-2.0) |
fs-dotdot-absent-root |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/literal-path-entries.test.ts (Apache-2.0) |
fs-hardlink-create-write-out |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/write-through-links.test.ts (Apache-2.0) |
fs-hardlink-widen-write |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/integration.test.ts (Apache-2.0) |
fs-symlink-dangling-create |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/write-through-links.test.ts (Apache-2.0) |
fs-symlink-file-out-agent-made |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/write-through-links.test.ts (Apache-2.0) |
fs-symlink-rename-out |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/write-through-links.test.ts (Apache-2.0) |
fs-traversal-write-escape-dotdot |
high | linux, macos | OpenHands/software-agent-sdk tests/sdk/io/test_local_filestore_security.py::test_path_traversal_attacks_blocked (MIT) |
fs-writable-root-symlink-out |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/symlink-write-path.test.ts (Apache-2.0) |
fs-writable-root-symlink-parent |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/symlink-boundary.test.ts (Apache-2.0) |
read-allow-writable-carveout-trailing-slash-by-omission |
medium | linux, macos | anthropics/sandbox-runtime test/sandbox/trailing-slash-deny-spellings.test.ts (Apache-2.0) |
read-allow-writable-carveout-trailing-slash |
medium | linux, macos | anthropics/sandbox-runtime test/sandbox/trailing-slash-deny-spellings.test.ts (Apache-2.0) |
write-deny-absent-deep |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/mandatory-deny-paths.test.ts (Apache-2.0) |
write-deny-backslash-absent |
medium | linux, macos | anthropics/sandbox-runtime test/sandbox/names-with-a-backslash.test.ts (Apache-2.0) |
write-deny-covers-nested-root |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/readonly-deny-dir-binds.test.ts (Apache-2.0) |
write-deny-cut-short-hop |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/rules-through-links-on-every-runtime.test.ts (Apache-2.0) |
write-deny-dangling-link-target |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/rules-through-links-on-every-runtime.test.ts (Apache-2.0) |
write-deny-equals-root |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/readonly-deny-dir-binds.test.ts (Apache-2.0) |
write-deny-existing-file-chmod |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/stale-mount-point.test.ts (Apache-2.0) |
write-deny-glob-chars-dir |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/literal-path-entries.test.ts (Apache-2.0) |
write-deny-link-dotdot |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/rules-through-links-on-every-runtime.test.ts (Apache-2.0) |
write-deny-noncanonical-absent |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/path-canonicalization.test.ts (Apache-2.0) |
write-deny-symlinked-parent |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/symlinked-deny-paths.test.ts (Apache-2.0) |
write-deny-through-policy-symlink |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/mandatory-deny-paths.test.ts (Apache-2.0) |
write-deny-trailing-slash |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/readonly-deny-dir-stubs.test.ts (Apache-2.0) |
write-deny-under-dotdot-root |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/literal-path-entries.test.ts (Apache-2.0) |
write-deny-unsearchable-dir |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/literal-path-entries.test.ts (Apache-2.0) |
ipc¶
| contract | severidad | os | source |
|---|---|---|---|
ipc-abstract-unix-socket |
critical | linux | nolabs-ai/nono crates/nono/src/sandbox/linux.rs (test_abstract_unix_socket_scope_blocks_external_connect_on_v6) (Apache-2.0) |
ipc-unix-bind-denied |
high | macos | anthropics/sandbox-runtime test/sandbox/macos-seatbelt.test.ts (Apache-2.0) |
ipc-unix-socket-alias |
critical | macos | openai/codex codex-rs/sandboxing/src/seatbelt_daemon_socket_tests.rs::daemon_sockets_are_denied_despite_network_and_tmp_write_grants (Apache-2.0) |
ipc-unix-socket-allowlist |
high | macos | nolabs-ai/nono crates/nono-cli/tests/socket_access_run.rs (bypassed socket allowed, sibling blocked; exact vs subtree scope) (Apache-2.0) |
ipc-unix-socket-in-denied-dir-by-omission |
critical | linux, macos | nolabs-ai/nono crates/nono-cli/tests/socket_access_run.rs (filesystem_directory_deny_blocks_nested_unix_socket_connect_on_macos) (Apache-2.0) |
ipc-unix-socket-in-denied-dir |
critical | linux, macos | nolabs-ai/nono crates/nono-cli/tests/socket_access_run.rs (filesystem_directory_deny_blocks_nested_unix_socket_connect_on_macos) (Apache-2.0) |
isolation¶
| contract | severidad | os | source |
|---|---|---|---|
isolation-apple-events-denied |
high | macos | anthropics/sandbox-runtime test/sandbox/macos-apple-events.test.ts (Apache-2.0) |
isolation-clone-newns-denied |
high | linux | anthropics/sandbox-runtime test/docker-weak-sandbox.test.ts (Apache-2.0) |
isolation-gpu-node-denied |
medium | linux | nolabs-ai/nono tests/integration/test_gpu.sh ("render node / nvidia0 / nvidiactl / kfd / dxg denied without --allow-gpu") (Apache-2.0) |
isolation-nested-relaunch-no-widen |
critical | linux, macos | nolabs-ai/nono tests/integration/test_child_tool_boundaries.sh ("command sandbox does not inherit session --allow directory") (Apache-2.0) |
isolation-no-capabilities |
high | linux | openai/codex codex-rs/linux-sandbox/tests/suite/sandbox.rs::sandboxed_command_has_no_effective_or_permitted_capabilities; idea also in containers/bubblewrap tests/test-run.sh "we have no caps" (LGPL-2.1-or-later, idea only) |
isolation-no-effective-caps |
high | linux | anthropics/sandbox-runtime test/sandbox/pid-namespace-isolation.test.ts (Apache-2.0) |
isolation-no-nested-userns |
high | linux | containers/bubblewrap tests/test-run.sh "can disable nested userns" (LGPL-2.1-or-later, idea only) |
isolation-no-new-privs |
high | linux | anthropics/sandbox-runtime test/sandbox/integration.test.ts (Apache-2.0) |
isolation-pid1-reaper-filtered |
medium | linux | openai/codex codex-rs/linux-sandbox/tests/suite/managed_proxy.rs::sandboxed_commands_have_a_seccomp_filtered_namespace_reaper and ::namespace_reaper_collects_orphaned_descendants (Apache-2.0) |
isolation-proc-mem-launcher-denied |
critical | linux | anthropics/sandbox-runtime test/sandbox/pid-namespace-isolation.test.ts (Apache-2.0) |
isolation-proc-sys-write-denied |
high | linux | nolabs-ai/nono tests/integration/test_gpu.sh ("/proc/self/task/ |
isolation-process-info-environ |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/pid-namespace-isolation.test.ts (Apache-2.0) |
isolation-process-info-foreign |
high | linux | nolabs-ai/nono tests/integration/test_system_paths.sh ("cannot read foreign /proc/1/maps", "/proc/self readable", grandchild /proc/self issue #602) (Apache-2.0) |
isolation-ptrace-launcher-denied |
critical | linux | anthropics/sandbox-runtime test/sandbox/pid-namespace-isolation.test.ts (Apache-2.0) |
isolation-root-mount-bypass-denied-by-omission |
critical | linux | anthropics/sandbox-runtime test/docker-weak-sandbox.test.ts (Apache-2.0) |
isolation-root-mount-bypass-denied |
critical | linux | anthropics/sandbox-runtime test/docker-weak-sandbox.test.ts (Apache-2.0) |
isolation-seccomp-io-uring-denied |
high | linux | nolabs-ai/nono crates/nono-cli/tests/execution_strategy_run.rs (cli_auto_block_net_uses_static_seccomp_baseline: "IO_URING -1 1") (Apache-2.0) |
isolation-signal-host-process |
critical | linux, macos | nolabs-ai/nono crates/nono/src/sandbox/linux.rs (test_signal_scope_blocks_external_kill_on_v6) (Apache-2.0) |
isolation-supervisor-proc-mem-denied |
critical | linux | anthropics/sandbox-runtime test/docker-weak-sandbox.test.ts (Apache-2.0) |
isolation-vsock-socket-denied |
high | linux | anthropics/sandbox-runtime test/docker-weak-sandbox.test.ts (Apache-2.0) |
seccomp-clone-newuser-denied |
high | linux | anthropics/sandbox-runtime test/sandbox/linux-nested-userns.test.ts (Apache-2.0) |
seccomp-new-mount-api-denied |
medium | linux | anthropics/sandbox-runtime test/sandbox/linux-nested-userns.test.ts and seccomp-filter-generator.test.ts (Apache-2.0) |
usability-dev-nodes-and-ipc |
medium | linux, macos | openai/codex codex-rs/linux-sandbox/tests/suite/sandbox.rs::bwrap_populates_minimal_dev_nodes, codex-rs/exec/tests/suite/sandbox.rs::python_multiprocessing_lock_works_under_sandbox / python_getpwuid_works_under_sandbox / allow_unix_socketpair_recvfrom (Apache-2.0) |
lifecycle¶
| contract | severidad | os | source |
|---|---|---|---|
lifecycle-background-reaped-on-exit |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/integration.test.ts and pid-namespace-isolation.test.ts (Apache-2.0) |
lifecycle-effect-log-tamper |
high | linux, macos | nolabs-ai/nono tests/integration/test_sensitive_paths.sh ("Internal State Protection": grants overlapping ~/.nono are rejected) (Apache-2.0) |
lifecycle-exit-status-forwarded |
medium | linux, macos | anthropics/sandbox-runtime test/sandbox/pid-namespace-isolation.test.ts and integration.test.ts (Apache-2.0) |
lifecycle-no-host-artifacts |
medium | linux, macos | anthropics/sandbox-runtime test/sandbox/mandatory-deny-paths.test.ts (Apache-2.0) |
lifecycle-signal-teardown |
high | linux, macos | nolabs-ai/nono tests/integration/test_exec_strategy.sh ("SIGTERM forwarded to child (nono exited after signal)") (Apache-2.0) |
network¶
| contract | severidad | os | source |
|---|---|---|---|
network-broker-allowlist-lookalike |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/domain-pattern.test.ts and test/sandbox/canonical-host-routing.test.ts (Apache-2.0) |
network-broker-host-header-spoof |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/request-filter.test.ts (Apache-2.0) |
network-broker-internal-ip-spellings |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/canonical-host-routing.test.ts (Apache-2.0) |
network-broker-no-request-smuggling |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/client-abort.test.ts and test/sandbox/trailers-then-request.test.ts (Apache-2.0) |
network-broker-path-dot-segments |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/request-target-forwarding.test.ts (Apache-2.0) |
network-broker-ssrf-internal |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/resolved-address-guard.test.ts (Apache-2.0) |
network-broker-survives-malformed-client |
medium | linux, macos | anthropics/sandbox-runtime test/sandbox/client-abort.test.ts (Apache-2.0) |
network-domain-allowlist-direct-bypass |
critical | linux, macos | nolabs-ai/nono tests/integration/test_network.sh ("proxy mode blocks direct curl bypass with --noproxy", "python-dev profile blocks hosts outside developer allowlist") (Apache-2.0) |
network-egress-public-denied |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/macos-allow-local-binding.test.ts (Apache-2.0) |
network-icmp-denied |
high | linux, macos | nolabs-ai/nono tests/integration/test_network.sh ("ping blocked with --block-net") (Apache-2.0) |
network-local-bind-denied |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/macos-allow-local-binding.test.ts (Apache-2.0) |
network-other-socket-families-denied |
high | linux | openai/codex codex-rs/linux-sandbox/tests/suite/managed_proxy_unix_sockets_tests.rs::managed_proxy_allow_all_unix_sockets_preserves_network_isolation (Apache-2.0) |
network-proxy-env-present |
medium | linux, macos | anthropics/sandbox-runtime test/sandbox/proxy-env-vars.test.ts (Apache-2.0) |
network-socket-domain-high-bits |
high | linux | anthropics/sandbox-runtime test/sandbox/seccomp-vsock-block.test.ts (Apache-2.0) |
network-tcp-external-denied |
critical | linux, macos | openai/codex codex-rs/linux-sandbox/tests/suite/sandbox.rs::sandbox_blocks_curl and codex-rs/sandboxing/src/seatbelt_network_tests.rs::external_dns_child (Apache-2.0) |
network-vsock-denied |
high | linux | anthropics/sandbox-runtime test/sandbox/seccomp-vsock-block.test.ts (Apache-2.0) |
seccomp-io-uring-denied |
critical | linux | anthropics/sandbox-runtime test/sandbox/pid-namespace-isolation.test.ts (Apache-2.0) |
resources¶
| contract | severidad | os | source |
|---|---|---|---|
resources-cgroup-escape |
high | linux | nolabs-ai/nono crates/nono-cli/src/lineage_cgroup.rs (live_landlock_denies_child_write_to_cgroup_procs) (Apache-2.0) |
secrets¶
| contract | severidad | os | source |
|---|---|---|---|
read-allow-inside-deny-writable-ancestor |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/allow-read.test.ts (Apache-2.0) |
read-allow-symlink-into-deny-by-omission |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/linux-mount-plan-record.test.ts (Apache-2.0) |
read-allow-symlink-into-deny |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/linux-mount-plan-record.test.ts (Apache-2.0) |
read-allow-symlink-no-reopen-by-omission |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/read-deny-glob.test.ts, test/sandbox/read-list-precedence.test.ts (Apache-2.0) |
read-allow-symlink-no-reopen |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/read-deny-glob.test.ts, test/sandbox/read-list-precedence.test.ts (Apache-2.0) |
read-allow-trailing-slash-nested-deny |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/trailing-slash-deny-spellings.test.ts (Apache-2.0) |
read-deny-alt-spelling-by-omission |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/linux-one-mount-per-destination.test.ts (Apache-2.0) |
read-deny-alt-spelling |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/linux-one-mount-per-destination.test.ts (Apache-2.0) |
read-deny-around-nested-root-by-omission |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/readonly-deny-dir-binds.test.ts (Apache-2.0) |
read-deny-around-nested-root |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/readonly-deny-dir-binds.test.ts (Apache-2.0) |
read-deny-backslash-name-by-omission |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/names-with-a-backslash.test.ts (Apache-2.0) |
read-deny-backslash-name |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/names-with-a-backslash.test.ts (Apache-2.0) |
read-deny-bracket-dir-by-omission |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/brackets-that-spell-no-set.test.ts (Apache-2.0) |
read-deny-bracket-dir |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/brackets-that-spell-no-set.test.ts (Apache-2.0) |
read-deny-given-via-symlink-by-omission |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/read-list-precedence.test.ts, test/sandbox/read-deny-glob.test.ts (Apache-2.0) |
read-deny-given-via-symlink |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/read-list-precedence.test.ts, test/sandbox/read-deny-glob.test.ts (Apache-2.0) |
read-deny-link-dotdot-by-omission |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/rules-through-links-on-every-runtime.test.ts (Apache-2.0) |
read-deny-link-dotdot |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/rules-through-links-on-every-runtime.test.ts (Apache-2.0) |
read-deny-not-reopened-by-nested-writable-by-omission |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/default-write-paths.test.ts (Apache-2.0) |
read-deny-not-reopened-by-nested-writable |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/default-write-paths.test.ts (Apache-2.0) |
read-deny-root-carve-out |
high | linux | anthropics/sandbox-runtime test/sandbox/allow-read.test.ts (Apache-2.0) |
read-deny-symlink-entry |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/linux-mount-plan-record.test.ts (Apache-2.0) |
read-deny-symlinked-dir |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/symlinked-deny-paths.test.ts (Apache-2.0) |
read-deny-trailing-slash-nested-write-deny |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/trailing-slash-deny-spellings.test.ts (Apache-2.0) |
read-deny-under-write-deny |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/readonly-deny-dir-binds.test.ts (Apache-2.0) |
secrets-env-loader-injection-inherit |
medium | linux, macos | nolabs-ai/nono tests/integration/test_env_sanitization.sh + crates/nono-cli/src/exec_strategy/env_sanitization.rs (Apache-2.0) |
secrets-env-loader-injection-scrub |
high | linux, macos | nolabs-ai/nono tests/integration/test_env_sanitization.sh (LD_PRELOAD, LD_LIBRARY_PATH, DYLD_INSERT_LIBRARIES, PYTHONSTARTUP, NODE_OPTIONS, PERL5OPT) (Apache-2.0) |
secrets-env-passthrough-selective |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/credential-deny.test.ts (Apache-2.0) |
secrets-env-scrub-common-tokens |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/credential-deny.test.ts, credential-mask-env.test.ts, credential-mask.test.ts (Apache-2.0) |
secrets-glob-deny-created-after-start |
high | macos | nolabs-ai/nono crates/nono-cli/tests/glob_deny_after_start_run.rs (double_star / single_star / deleted_and_recreated) (Apache-2.0) |
secrets-glob-deny-rename-out |
critical | macos | anthropics/sandbox-runtime test/sandbox/allow-read.test.ts (Apache-2.0) |
secrets-glob-read-deny |
high | macos | anthropics/sandbox-runtime test/sandbox/glob-expand.test.ts (Apache-2.0) |
secrets-home-credentials-in-writable |
high | linux, macos | openai/codex codex-rs/sandboxing/src/seatbelt_tests.rs::seatbelt_protects_aws_in_extra_writable_home and codex-rs/linux-sandbox/tests/suite/sandbox.rs::sandbox_blocks_metadata_writes_inside_writable_root (Apache-2.0) |
secrets-host-process-environ |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/execute-only-binary.test.ts (Apache-2.0) |
secrets-proc-host-process-links |
high | linux | openai/codex codex-rs/linux-sandbox/tests/suite/daemon_sockets_tests.rs::daemon_sockets_are_hidden_with_network_and_tmp_write_grants (host-proc mode) (Apache-2.0) |
secrets-read-allow-symlink-hop-no-widen-by-omission |
high | linux, macos | nolabs-ai/nono crates/nono-cli/tests/symlink_hop_run.rs + symlink_hop_run_linux.rs (Apache-2.0) |
secrets-read-allow-symlink-hop-no-widen |
high | linux, macos | nolabs-ai/nono crates/nono-cli/tests/symlink_hop_run.rs + symlink_hop_run_linux.rs (Apache-2.0) |
secrets-read-allow-symlink-into-deny-by-omission |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/linux-ancestor-pin.test.ts (Apache-2.0) |
secrets-read-allow-symlink-into-deny |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/linux-ancestor-pin.test.ts (Apache-2.0) |
secrets-read-deny-after-chmod |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/linux-ancestor-pin-errno.test.ts (Apache-2.0) |
secrets-read-deny-also-write-denied |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/wrap-with-sandbox.test.ts (Apache-2.0) |
secrets-read-deny-case-fold |
critical | macos | anthropics/sandbox-runtime test/sandbox/allow-read.test.ts (Apache-2.0) |
secrets-read-deny-clonefile |
critical | macos | anthropics/sandbox-runtime test/sandbox/allow-read.test.ts (Apache-2.0) |
secrets-read-deny-dir-listing-by-omission |
high | linux, macos | nolabs-ai/nono tests/integration/test_sensitive_paths.sh ("~/.ssh directory blocked": ls ~/.ssh/) and test_gpu.sh (READ_DIR vs READ_FILE caveat) (Apache-2.0) |
secrets-read-deny-dir-listing |
high | linux, macos | nolabs-ai/nono tests/integration/test_sensitive_paths.sh ("~/.ssh directory blocked": ls ~/.ssh/) and test_gpu.sh (READ_DIR vs READ_FILE caveat) (Apache-2.0) |
secrets-read-deny-firmlink |
critical | macos | anthropics/sandbox-runtime test/sandbox/allow-read.test.ts (Apache-2.0) |
secrets-read-deny-on-symlinked-path-by-omission |
critical | linux, macos | nolabs-ai/nono crates/nono-cli/tests/symlink_hop_run.rs (symlinked grants must resolve) (Apache-2.0) |
secrets-read-deny-on-symlinked-path |
critical | linux, macos | nolabs-ai/nono crates/nono-cli/tests/symlink_hop_run.rs (symlinked grants must resolve) (Apache-2.0) |
secrets-read-deny-path-special-chars-by-omission |
high | linux, macos | nolabs-ai/nono tests/integration/test_edge_cases.sh ("path with spaces", "dashes and underscores") (Apache-2.0) |
secrets-read-deny-path-special-chars |
high | linux, macos | nolabs-ai/nono tests/integration/test_edge_cases.sh ("path with spaces", "dashes and underscores") (Apache-2.0) |
secrets-read-deny-prefix-collision-by-omission |
critical | linux, macos | nolabs-ai/nono tests/integration/test_sensitive_paths.sh ("Path Collision Bypass Prevention": ~/.sshfoo, ~/.awsbackup) (Apache-2.0) |
secrets-read-deny-prefix-collision |
critical | linux, macos | nolabs-ai/nono tests/integration/test_sensitive_paths.sh ("Path Collision Bypass Prevention": ~/.sshfoo, ~/.awsbackup) (Apache-2.0) |
secrets-read-deny-rename-out |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/read-list-precedence.test.ts, test/sandbox/allow-read.test.ts (Apache-2.0) |
secrets-read-deny-single-file-by-omission |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/credential-deny.test.ts (Apache-2.0) |
secrets-read-deny-single-file |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/credential-deny.test.ts (Apache-2.0) |
secrets-read-deny-symlinked-entry-by-omission |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/credential-deny.test.ts (Apache-2.0) |
secrets-read-deny-symlinked-entry |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/credential-deny.test.ts (Apache-2.0) |
secrets-read-deny-under-write-denied-ancestor |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/wrap-with-sandbox.test.ts (Apache-2.0) |
secrets-read-deny-via-proc-self-root |
critical | linux | denoland/deno tests/specs/permission/special (GHSA-m87g-7g5m-wpx4, /proc/self/root) (MIT) |
secrets-traversal-read-escape-dotdot |
critical | linux, macos | OpenHands/software-agent-sdk tests/sdk/io/test_local_filestore_security.py::test_path_traversal_attacks_blocked (MIT) |
trust-handoff¶
| contract | severidad | os | source |
|---|---|---|---|
trust-handoff-bracketed-root |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/macos-literal-deny-brackets.test.ts (Apache-2.0) |
trust-handoff-claude-agents |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/mandatory-deny-paths.test.ts (Apache-2.0) |
trust-handoff-claude-symlink-cycle |
high | linux | anthropics/sandbox-runtime test/sandbox/symlinked-deny-paths.test.ts (Apache-2.0) |
trust-handoff-editor-dirs |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/mandatory-deny-paths.test.ts (Apache-2.0) |
trust-handoff-git-config-move-aside |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/linux-nested-userns.test.ts (Apache-2.0) |
trust-handoff-git-config |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/mandatory-deny-paths.test.ts (Apache-2.0) |
trust-handoff-git-dir-replace |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/linux-ancestor-pin.test.ts (Apache-2.0) |
trust-handoff-git-exchange-rename |
critical | linux | anthropics/sandbox-runtime test/sandbox/linux-ancestor-pin.test.ts (Apache-2.0) |
trust-handoff-gitdir-pointer |
critical | linux, macos | openai/codex codex-rs/linux-sandbox/tests/suite/nested_metadata_tests.rs::workspace_write_protects_resolved_gitdir_in_another_writable_root and codex-rs/sandboxing/src/seatbelt_tests.rs::workspace_write_protects_linked_worktree_gitdir_under_tmp (Apache-2.0) |
trust-handoff-gitignored-repo |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/mandatory-deny-paths.test.ts (Apache-2.0) |
trust-handoff-gitmodules |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/mandatory-deny-paths.test.ts (Apache-2.0) |
trust-handoff-hooks-dir-absent |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/mandatory-deny-paths.test.ts (Apache-2.0) |
trust-handoff-repo-created-in-run |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/mandatory-deny-paths.test.ts (Apache-2.0) |
trust-handoff-root-inside-hooks |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/readonly-deny-dir-binds.test.ts (Apache-2.0) |
trust-handoff-shell-rc |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/mandatory-deny-paths.test.ts (Apache-2.0) |
trust-handoff-symlink-absent-parent |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/macos-seatbelt.test.ts (Apache-2.0) |
trust-handoff-symlinked-claude-dir |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/symlinked-deny-paths.test.ts (Apache-2.0) |
trust-handoff-tool-rc |
high | linux, macos | anthropics/sandbox-runtime test/sandbox/mandatory-deny-paths.test.ts (Apache-2.0) |
trust-handoff-unreadable-at-compile |
critical | linux, macos | anthropics/sandbox-runtime test/sandbox/mandatory-deny-paths.test.ts (Apache-2.0) |
trust-handoff-worktree-gitfile |
medium | linux, macos | anthropics/sandbox-runtime test/sandbox/mandatory-deny-paths.test.ts (Apache-2.0) |