[haacked]

Problem

A malicious dependency in a sandboxed dev service can run code on the developer's Mac outside the sandbox, with full privileges. Two routes reach that. Neither depends on the sandbox's read rules.

• The profile write-denies .git/hooks, because hooks run outside Seatbelt. It leaves git's config files writable. core.hooksPath relocates the hook directory those denies protect, and git runs core.fsmonitor on ordinary read commands. A dependency appends two lines, and the developer's next git status runs its command.
• The wrapper resolves binaries through the inherited PATH while it still runs unsandboxed. That PATH keeps the repo's own node_modules/.bin, which sandboxed code can write. A binary planted on one run executes as the developer on the next.

Changes

Nothing looks different. Every change removes access, except the last, which moves one setup step.

Git config, all reached by the first route:

• The profile write-denies .git/config and .git/config.worktree for both repo roots.
• The profile write-denies the .git node itself. In a worktree that node is a file holding gitdir: <path>. Rewriting it repoints git at a directory the attacker controls, which brings its own config.
• The profile write-denies Homebrew's system gitconfig, at the Apple Silicon and Intel prefixes. A brew-installed git reads it on every invocation, and the developer's own account owns it. The Xcode one is root-owned and already out of reach.
• The wrapper write-denies the worktree's real git dir at runtime. That directory sits under the main repo, so no PROJECT-relative rule reaches it. This repo sets extensions.worktreeConfig, so the case is live here.

PATH, the second route:

• The wrapper pins PATH to the system directories for its own use. The child and the unsandboxed passthrough still get the developer's real PATH.
• The wrapper runs /usr/bin/sandbox-exec by absolute path. The final exec hands the child's PATH to env, and that PATH keeps the repo's writable bins. A bare name let sandboxed code plant the binary that creates the sandbox.

One setup step moves:

• The flox activation seeds blame.ignoreRevsFile, which package.json's postinstall did before. That script runs inside the sandbox, so the write failed behind its own || true and a fresh clone never got the setting. A pnpm install outside flox no longer seeds it.

Denying a .git node leaves entries inside a real .git directory alone, so ordinary git writes still work. Cargo's git-dependency writes go to ~/.cargo/git/db.

Note

Git config files reached through [include] stay writable, and stay unreadable inside the sandbox. The read failure breaks cargo builds with could not stat '~/.gitconfig...': Operation not permitted. The write gap leaves the first route open through a file this profile does not name. Both need one mechanism: enumerate the files git reports, instead of listing them by hand. #79300 holds that work.

How did you test this code?

bin/dev-sandbox-selftest gains four cases. Each one was verified to fail with its own deny reverted.

• A write to the repo's .git/config. No existing case covered it.
• A write to a worktree's .git redirect file. The case builds a throwaway worktree instead of probing this checkout. Appending to a directory fails on its own, so on a plain clone the probe would report success without the sandbox being involved.
• A write to the per-worktree config.worktree.
• A write to Homebrew's system gitconfig, when that file exists.

Ran locally on macOS 26.6. Checked by hand there:

• git status, git log, git rev-parse and a repo write still work inside the sandbox.
• A planted sed, mktemp, cat, mv, rm, touch, cut, uname or dirname no longer runs during the pre-sandbox phase.
• The rendered profile comes out byte-identical, with the same cache key, across a worktree, a plain clone, and a checkout whose .git is a symlink.
• The flox activation sets blame.ignoreRevsFile on a fresh repo and leaves an existing value alone.

Check 12 now renders into a private TMPDIR. Globbing the shared one turned up profiles left by other worktrees, which this sandbox does not deny. Clearing those evicted a cache those worktrees were still using.

Not checked: Linux, where the wrapper exits early and does nothing. CI runs the self-test on depot-macos-15.

Automatic notifications

• Publish to changelog?

Docs update

None. No user-facing behavior or documented workflow changes.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Claude Code (Opus 5) in PostHog Desktop. Skills invoked: /security-review, /writing-pr-descriptions, /address-pr-reviews, /squash, /simplify, /explain-open, /followup.

This began as one branch. That branch also taught the sandbox to follow [include] chains in the developer's git config, to fix the cargo failure noted above. Adversarial review rounds kept finding escapes in that half. Three of those were introduced by earlier fixes in the same session. So the work was split. This PR carries only the half that removes access and adds no new capability. The discovery half stays in #79300 for redesign.

The .git node and config.worktree denies came from probing, not from a report. Both are live on this repo, which uses worktrees with extensions.worktreeConfig.

A later cleanup pass probed every file git config --list --show-origin reports. That found the writable Homebrew gitconfig, the bare sandbox-exec, and the postinstall whose config write the new denies had started swallowing. It also measured the [include] gap the note above records. Those files look protected on this machine only because they are symlinks into a read-denied directory. A plain file in their place is writable.

---

Created with PostHog Desktop

[trunk-io]

😎 Merged successfully - details.

[github-actions]

🤖 CI report

🚨 Trunk lane — universal lane

This PR is assigned to the universal lane. It cannot merge in parallel with other PRs, so it can take longer to merge. Ask dev-ex if you think this is wrong.

⚠️ Bundle size — 🔺 +32.4 KiB (+0.0%)

Uncompressed size of every built .js bundle, compared against the base branch.

Total: 68.53 MiB · 🔺 +32.4 KiB (+0.0%)

File	Size	Δ vs base
render-query/src/render-query/render-query.js	21.67 MiB	🔺 +9.2 KiB (+0.0%)
exporter/src/queries/schema.js	1.16 MiB	🔺 +9.0 KiB (+0.8%)
posthog-app/src/queries/schema.js	1.16 MiB	🔺 +9.0 KiB (+0.8%)
posthog-app/_parent/products/engineering_analytics/frontend/scenes/EngineeringAnalyticsScene.js	61.8 KiB	🔺 +3.2 KiB (+5.4%)
posthog-app/_parent/products/signals/frontend/inbox/InboxScene.js	704.0 KiB	🔺 +1.5 KiB (+0.2%)

_{Posted automatically by build-bundle-size-report · uncompressed bytes from dist-report}

✅ Eager graph — within budget

How much code each root ships on the eager path — downloaded and parsed before the surface is interactive. Measured from the esbuild output chunks (post-tree-shake, static imports only); lazy import() / React.lazy chunks are not counted.

Root	Eager (shipped)	Δ vs base	Budget
entry (logged-out pages, app bootstrap) src/index.tsx	1.36 MiB · 22 files	🔺 +211 B (+0.0%)	███░░░░░░░ 30.2% of 4.51 MiB
authenticated shell (every logged-in page) src/scenes/AuthenticatedShell.tsx	8.77 MiB · 3,235 files	🔺 +130 B (+0.0%)	█████████░ 90.2% of 9.71 MiB

🟢 node_modules/monaco-editor/ stays out of src/index.tsx
🟢 src/lib/components/ActivityLog/describers stays out of src/index.tsx
🟢 [object Object] stays out of src/index.tsx
🟢 [object Object] stays out of src/index.tsx
🟢 node_modules/monaco-editor/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/lib/components/ActivityLog/describers stays out of src/scenes/AuthenticatedShell.tsx
🟢 [object Object] stays out of src/scenes/AuthenticatedShell.tsx
🟢 [object Object] stays out of src/scenes/AuthenticatedShell.tsx

Largest files eagerly shipped from src/index.tsx

Size	File
126.8 KiB	../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js
24.6 KiB	../node_modules/.pnpm/buffer@6.0.3/node_modules/buffer/index.js
6.3 KiB	../node_modules/.pnpm/react@18.3.1/node_modules/react/cjs/react.production.min.js
4.5 KiB	../node_modules/.pnpm/@jspm+core@2.1.0/node_modules/@jspm/core/nodelibs/browser/process.js
3.9 KiB	../node_modules/.pnpm/scheduler@0.23.2/node_modules/scheduler/cjs/scheduler.production.min.js
1.4 KiB	../node_modules/.pnpm/base64-js@1.5.1/node_modules/base64-js/index.js
1.3 KiB	src/RootErrorBoundary.tsx
912 B	../node_modules/.pnpm/ieee754@1.2.1/node_modules/ieee754/index.js
789 B	src/scenes/ChunkLoadErrorBoundary.tsx
762 B	src/index.tsx

Largest files eagerly shipped from src/scenes/AuthenticatedShell.tsx

Size	File
306.5 KiB	../node_modules/.pnpm/posthog-js@1.418.17/node_modules/posthog-js/dist/rrweb.js
267.7 KiB	../node_modules/.pnpm/@posthog+icons@0.38.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js
258.5 KiB	../node_modules/.pnpm/posthog-js@1.418.17/node_modules/posthog-js/dist/module.js
246.0 KiB	src/taxonomy/core-filter-definitions-by-group.json
154.2 KiB	../node_modules/.pnpm/re2js@0.4.1/node_modules/re2js/build/index.esm.js
126.8 KiB	../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js
104.6 KiB	src/lib/api.ts
95.1 KiB	../packages/quill/packages/quill/dist/index.js
93.3 KiB	../node_modules/.pnpm/prosemirror-view@1.40.1/node_modules/prosemirror-view/dist/index.js
90.6 KiB	../node_modules/.pnpm/@tiptap+core@3.20.6_@tiptap+pm@3.20.6/node_modules/@tiptap/core/dist/index.js

_{Posted automatically by check-eager-graph · sizes are eager output bytes (shipped, post-tree-shake) from the esbuild metafile · part of #32479}

✅ Toolbar bundle — eager 2.25 MiB within budget

What the toolbar ships to customer pages, measured from the esbuild output (minified, post-tree-shake). The eager set is the entry plus everything statically imported from it — fetched before any feature runs; deferred chunks load lazily. The eager guardrail is 5.72 MiB. Each output file must also stay below 10 MB, where CloudFront stops compressing it. The module boundary is enforced separately by check-toolbar-graph.

Metric	Size	Δ vs base	Budget
Eager (shipped) entry + static imports	2.25 MiB · 17 files	🔺 +211 B (+0.0%)	████░░░░░░ 39.3% of 5.72 MiB
Deferred (lazy)	2.09 MiB · 33 files	no change	n/a — loads on demand
Loader dist/toolbar.js	1.1 KiB	no change	█░░░░░░░░░ 5.8% of 19.5 KiB

Largest eagerly-shipped chunks

Size	File
745.9 KiB	dist/toolbar/toolbar-app-QDEUOQFO.css
582.9 KiB	dist/toolbar/chunk-chunk-YRYIO5AK.js
484.6 KiB	dist/toolbar/chunk-chunk-7TYJBGPX.js
133.8 KiB	dist/toolbar/chunk-chunk-HUJ6YVZZ.js
131.8 KiB	dist/toolbar/chunk-chunk-T5KY5WYR.js
71.2 KiB	dist/toolbar/toolbar-app-2USHGT3U.js
69.0 KiB	dist/toolbar/chunk-chunk-27JL52RE.js
35.6 KiB	dist/toolbar/chunk-chunk-5I6DF2DA.js
20.9 KiB	dist/toolbar/chunk-chunk-WRHMR2RW.js
12.2 KiB	dist/toolbar/chunk-chunk-PIK3PADE.js

_{Posted automatically by check-toolbar-size · sizes are toolbar output bytes (shipped, post-tree-shake) from the esbuild metafile}

✅ Dist folder size — 🔺 +325.4 KiB (+0.0%)

Total size of the built frontend/dist folder (all assets), compared against the base branch.

Total: 1460.50 MiB · 🔺 +325.4 KiB (+0.0%)

✅ Playwright — all passed

All tests passed.

View test results →

[trunk-io]

   

View Full Report ↗︎ ⋅ Docs

[posthog]

✅ Visual changes approved by @haacked — baseline updated in d9c3eed.

View this run in PostHog

10 changed.

[posthog]

🦔 ReviewHog reviewed this pull request

Found 0 must fix, 1 should fix, 2 consider.

Published 3 findings (view the review).

Resolved comments: 4 declined, 8 left for you

[posthog]

ReviewHog Alpha 🦔 If you find any issues helpful - please reply "valid", "invalid", etc., for evaluation purposes 🙏

[posthog]

ReviewHog Report

Found 1 must fix.

[posthog-security-review-bot]

✅ Security review complete — 6597f141d0e8

3 findings posted as a review, in 11 min.

_{Re-request a team-security review to run again on the latest commit.}

[Copilot]

Pull request overview

Hardens the macOS dev sandbox wrapper and SBPL profile to prevent sandboxed dependency code from persisting malicious Git configuration or poisoning pre-sandbox binary resolution, while adding self-tests and moving repo-local Git config seeding to flox activation.

Changes:

• Write-deny additional Git config surfaces (.git/config, .git redirect file, config.worktree, and Homebrew’s system gitconfig paths) and expand execute-later write-denies in the SBPL profile.
• Pin the wrapper’s pre-sandbox PATH to system directories and invoke sandbox-exec via absolute path to prevent PATH poisoning.
• Extend bin/dev-sandbox-selftest with new regression checks and update flox activation to seed repo-local Git settings that postinstall can’t write under the sandbox.

Reviewed changes

Copilot reviewed 1 out of 4 changed files in this pull request and generated no comments.

File	Description
bin/dev-sandbox.sb	Adds new write-denies for git config and other execute-later targets, plus a narrow re-allow for Husky’s generated _ dir.
bin/dev-sandbox-selftest	Adds new checks for denied git config writes, worktree redirect handling, private TMPDIR profile checks, and PATH passthrough validation.
bin/dev-sandbox	Pins pre-sandbox PATH, uses absolute /usr/bin/sandbox-exec, and adds runtime write-denies for physical gitdir config paths.
.flox/env/on-activate.sh	Moves repo-local Git config seeding (ignore revs + hooksPath) to flox activation to avoid sandbox write-denies.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[greptile-apps]

_{Reviews (1): Last reviewed commit: "fix(dev): deny git-config and hook write..." | Re-trigger Greptile}

[stamphog]

This is security-sensitive sandboxing tooling, and ReviewHog's inline comment on bin/dev-sandbox flags a real, confirmed gap — the shebang still resolves bash through the untrusted inherited PATH before the new PATH pin takes effect, undermining the very escape this PR closes. The bot explicitly declined to auto-fix it because it changes the sandbox mechanism itself and asked a human to confirm the approach; that thread is still unresolved on the current head.

• Author wrote 0% of the modified lines and has 17 merged PRs in these paths (familiarity MODERATE).
• 👍 on the PR from greptile-apps[bot].
• Unresolved ReviewHog must-fix on bin/dev-sandbox: the #!/usr/bin/env bash shebang resolves the interpreter through the inherited (writable) PATH before the script's own PATH pin runs, leaving a PATH-based sandbox escape live despite this PR's stated purpose of closing exactly that class of bug.
• PR touches security-sandbox mechanism (Seatbelt profile generation, PATH handling) with no independent human sign-off yet; author is not on the owning team (@PostHog/team-devex) and familiarity is only MODERATE, not STRONG.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	383L, 4F substantive — within ceiling
tier	✓	T1-agent / T1d-complex (383L, 4F, two-areas, fix)
stamphog 2.0.0b4		.stamphog/policy.yml @ 6597f14 · reviewed head 6597f14

[greptile-apps]

_{Reviews (2): Last reviewed commit: "fix(dev): deny git-config and hook write..." | Re-trigger Greptile}

[posthog-security-review-bot]

Agent-driven security review - findings inline.

[posthog]

ReviewHog Report

Found 1 should fix, 2 consider.

[greptile-apps]

_{Reviews (3): Last reviewed commit: "fix(dev): deny git-config and hook write..." | Re-trigger Greptile}

[feliperalmeida]

Other than my inline comment, LGTM. Requesting changes to include the missing subpath unless there's a strong reason against it.

[feliperalmeida]

In my machine, /opt/homebrew/bin/npm resolves to ../Cellar/node/26.7.0/bin/npm and then /opt/homebrew/lib/node_modules/npm/bin/npm-cli.js.

The deny covers bin and Cellar but misses lib. We should add it, unless there's a reason not to.

[haacked]

Good catch! Added lib.

[gantoine]

security team to decide is this makes sense

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-08-26 18:42 UTC	Run
prod-us	✅ Deployed	2026-08-26 19:33 UTC	Run
prod-eu	✅ Deployed	2026-08-26 19:39 UTC	Run