Security
Flux can read files, edit code, and execute commands. Choose controls appropriate to the repository and environment.
#Permission modes
| Mode | Behavior |
|---|---|
ask |
Confirm sensitive actions and show edit diffs |
auto-accept |
Skip normal confirmations for faster trusted workflows |
deny-writes |
Block writes and mutation-oriented operations |
Set a default in configuration or use --auto-accept and --deny-writes at startup. allowedTools can auto-approve named tools or scoped command patterns.
#Shell sandbox
Flux auto-detects macOS Seatbelt and Linux Bubblewrap. The shell tool can also request Docker or no sandbox. Sandboxing filters environment variables whose names look like credentials and restricts common secret directories, but it is not a substitute for least-privilege credentials or isolated CI workers.
Set FLUX_NO_SANDBOX=1 only when you intentionally accept unsandboxed execution.
#Destructive command blocklist
High-risk patterns such as broad rm -rf, git reset --hard, force pushes, destructive disk commands, recursive ownership changes, database drops, and remote scripts piped to a shell are blocked by the shell tool even in auto-accept mode.
#Secrets and extensions
- Prefer API-key environment variables.
- Saved provider credentials are encrypted with AES-256-GCM before being written to global configuration.
- Do not commit secrets to
./.flux/config.json. - MCP servers and plugins are executable local integrations. Review their source and configuration before enabling them.
- Use narrow CI permissions and
--max-turnsto limit unattended work.