Trust Center
Every finding the Security agent has produced across all mesh runs, read back from the runs themselves. Findings above low severity are fed to Auto-Fix before a change proposal is allowed onto the merge train.
Findings
Loading…
Platform posture how CodeMesh itself is secured
✓Tokens are repo-scoped — a leaked fork token reaches exactly one repository
✓Write tokens are minted per operation with a short TTL and never leave the Worker
✓Agents never touch git: the coordinator is the only writer, so a prompt-injected agent cannot corrupt trunk
✓Agent output is treated as data — it becomes file contents, never executed
✓Repository names are validated against an allowlist pattern before creation