Security

Lanes security and privacy

In shortFile contents never reach the Lanes server. It receives repository identifiers, repo-relative paths, names, statuses, task titles, the team chat and requests, and keeps them in memory on a machine you run. Every request needs a token, even on localhost. Personal tokens are stored only as SHA-256 hashes. Text from a teammate is always quoted as data and capped in length, and no agent can approve a request on a person's behalf.

Updated 2026-11-12 · Lanes 0.3.0 · Source on GitHub

What leaves a developer's machine

LANES_NO_PROMPT_TEXT=1 replaces every task title with "Agent task" for one person.

What the server keeps

The server holds the team state in memory: leases, the queue, tasks, the last 200 hook events per repository, chat and requests. It stops, the state is gone. Its own token lives in a private file under ~/.lanes; member tokens are stored only as SHA-256 hashes, in a file readable by the owner alone.

Tokens and sign-in

• Every request carries a bearer token, even on localhost. The server also refuses unexpected Host headers, which blocks DNS rebinding, and refuses POST bodies that are not JSON, which blocks cross-site form posts.
• A shared team token lets teammates connect. Personal tokens from lanes invite tie each request to one person, and lanes remove revokes a token at once.
• GitHub sign-in uses the device flow through your own server. It needs only a public OAuth client id, no secret. The server reads the GitHub account id once, binds it to a member token and drops the GitHub access token.
• Admin actions (invite, remove) need the server's own token and a call from the server's own machine.

Text from teammates reaching your agent

With team context on, a teammate's chat message or request can end up in your agent's context. Lanes treats that text as untrusted input:

• It is always quoted, with its author named, and never phrased as an instruction from the system.
• Control characters, bidirectional overrides, zero-width and other invisible characters are stripped.
• Each message and the whole brief are capped in length.
• A request reaches your agent only after you approve it. The MCP server has no approve tool, so an agent cannot approve on your behalf.

What the hook commits

Lanes commits only what its agent changed during the turn. Files that were already changed when the prompt arrived belong to the person and are never included. Secret-looking files (.env*, keys, credentials, .npmrc) and files over 1 MB are never committed. The repository's own commit hooks run, so secret scanners still apply. Only Lanes' own commits are published, never the person's earlier local commits.

The browser app

The app at /app is a static page with a strict Content-Security-Policy: scripts, styles and connections only from the server itself, no inline script, nothing from a CDN. The token travels in the URL fragment, which the browser never sends to the server, is kept in sessionStorage and removed from the address bar. Teammate text is only ever rendered as text, never as HTML.

Known limits

• The server speaks plain HTTP. Off a trusted network, put it behind a TLS proxy or a VPN.
• Chat and requests are not end-to-end encrypted yet.
• Free text cannot be redacted perfectly. Use LANES_NO_PROMPT_TEXT=1 if your prompts may contain sensitive text.
• Anyone with access to the server machine can read the in-memory state and the server token.

Report a vulnerability privately through GitHub security advisories.

Questions