fix(sandbox): deny reads of Zero credential stores by PierrunoYT · Pull Request #681 · Gitlawb/zero

Commits on Jul 14, 2026

Commits on Jul 15, 2026

fix(sandbox): deny the whole Zero config dir, not itemized filenames

PierrunoYT
and
claude
committed

Commits on Jul 17, 2026

fix(sandbox): address macOS deny-path test and config parity

cursoragent
and
PierrunoYT
committed

Commits on Jul 18, 2026

Commits on Jul 19, 2026

Commits on Jul 20, 2026

Commits on Jul 25, 2026

Merge remote-tracking branch 'upstream/main' into agent/deny-zero-credential-reads
PierrunoYT
committed
test(sandbox): probe credential store reads in the Linux smoke test
PierrunoYT
committed

Commits on Jul 26, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(sandbox): deny reads of Zero credential stores - #681

fix(sandbox): deny reads of Zero credential stores#681
PierrunoYT wants to merge 23 commits into
Gitlawb:mainfrom
PierrunoYT:agent/deny-zero-credential-reads

Commits on Jul 14, 2026

fix(sandbox): deny reads of zero credential stores

fix(sandbox): address PR review comments

Commits on Jul 15, 2026

fix(sandbox): deny the whole Zero config dir, not itemized filenames

Commits on Jul 17, 2026

fix(sandbox): address macOS deny-path test and config parity

Commits on Jul 18, 2026

fix(sandbox): harden credential deny paths

test(cli): normalize credential deny baseline

fix(sandbox): close credential path gaps

test(sandbox): normalize command credential path

Commits on Jul 19, 2026

fix(sandbox): handle absent credential paths safely

fix(sandbox): protect MCP OAuth siblings

Commits on Jul 20, 2026

fix(sandbox): protect OAuth lock siblings

docs(sandbox): clarify Linux future-path limits

Commits on Jul 25, 2026

Merge remote-tracking branch 'upstream/main' into agent/deny-zero-credential-reads

test(sandbox): probe credential store reads in the Linux smoke test

Commits on Jul 26, 2026

fix(sandbox): keep the credential deny usable, current, and unguessable

Merge remote-tracking branch 'upstream/main' into agent/deny-zero-credential-reads

fix(sandbox): close credential deny review gaps

fix(sandbox): normalize credential carveout paths

fix(sandbox): canonicalize backend credential masks

test(sandbox): normalize backend mask expectations

Commits on Jul 27, 2026

Merge upstream/main into credential deny-read hardening

Commits on Jul 28, 2026

fix(sandbox): fail closed for replaceable token stores

Commits on Jul 29, 2026

Merge upstream/main into credential deny-read hardening, with review fixes