Security & trust

This page says what Codewhale does with your code, your commands, and your data — as implemented, not as intended. Each claim is drawn from a repository document that the facts gate checks on every build.

Where your data goes

Local runtime

The runtime, workspace state, and audit log stay on your machine.

Hosted provider

The hosted provider you select receives the turn context required for inference. There is no mandatory Codewhale relay in between.

Local inference

A loopback local-model route (vLLM, Ollama, SGLang) can keep inference on your machine entirely.

Account

No account is required for the local runtime.

Plan mode

Plan is read-only.

Approvals are not a sandbox

Approval posture — Ask, Auto-Review, Full Access — decides whether a proposed command is shown to you before it runs. An approval from one layer is never a universal bypass: a later layer can still require review or block the call, and an approval is not an operating-system sandbox grant. The full model tool-call pipeline is nine ordered layers, from effective configuration through hooks, typed permission rules, repository law, and human approval to the execution sandbox.

The OS sandbox, per platform

Only behaviour wired into the command execution path is described here, and Codewhale reports the mechanism it actually selected.

macOS — Seatbelt

Automatic when the runtime probe of sandbox-exec succeeds. Reported as macos-seatbelt.

Linux — bubblewrap

Opt-in: prefer_bwrap = true and an executable /usr/bin/bwrap. Reported as linux-bwrap.

Linux without bwrap

No OS wrapper by default. Reported as none.

Windows

No OS wrapper in the current implementation. Reported as none.

External service

sandbox_backend = "opensandbox" routes execution to an OpenSandbox-compatible service.

The repository also contains a seccomp module and a future Windows helper contract. Neither is wired into child-command launch, so Codewhale does not advertise them: source-only sandbox code is not evidence that a command was restricted.

Telemetry, exactly

Codewhale 0.9.12 counts anonymous usage by default and tells you so at first launch; the earlier 0.9.11 release asked first. Turning it off is a saved choice that later versions keep, and an opt-out recorded under the earlier opt-in policy stays off. Showing the notice never records any acceptance on your behalf; Codewhale and PostHog are named as the processors.

Never collected

Conversations, code, prompts, files, file/repo/branch names, model content, credentials, or any per-turn or per-tool timeline.

Sent while on

Version and platform classes, session duration and outcome, feature and error counters, closed enums, and a random install id that rotates every 90 days.

Endpoint

https://telemetry.codewhale.net/v1/telemetry — a first-party Cloudflare Worker whose source is in the repository under telemetry-ingest/.

First-party storage

No IP, country, or geo column. No request logs. Retention is a fixed three months.

PostHog

Optional forwarding requires separate operator configuration and verified IP-safe egress. PostHog retention is a separate project setting; source support does not mean the processor is active.

Audit it yourself

Set telemetry_endpoint = "": batches are appended to $CODEWHALE_HOME/telemetry/dryrun.jsonl on your machine, byte for byte what the server would have received, and no HTTP client is constructed.

Turn it off

codewhale config set telemetry false or CODEWHALE_TELEMETRY=0.

Local audit log

Sensitive events — credential, approval, and elevation events — append best-effort to $CODEWHALE_HOME/audit.log. Write failures are logged rather than hidden. Provider token and cache usage is shown locally when available.

Report a vulnerability

Send security reports by email to the maintainer rather than filing a public issue. Include the version from the masthead and a reproduction if you have one.