Permissions are the safety mechanism
Bolt does not ask you to trust one all-powerful agent. Every agent carries an access level the runtime enforces, so the blast radius of a bad answer is bounded before the model ever runs.
The three access levels
Read
Reads files and runs read-only commands. Cannot write to disk. Use it for exploration, review, and audits.
Edit
Can modify files, but not run arbitrary commands. Narrow by design — documentation work doesn't need a shell.
Full
Reads, writes, and executes. The agents that actually change your project, and the ones to be deliberate about.
Who can do what
codeplanaskcode-reviewdebugrefactordocssecuritymigrateperfCustom agents you define declare their own level, so the same rules apply to yours. More on how this plays out day to day in the FAQ.
Test before you apply
/sandbox lets the agent try changes in isolation before anything lands in your working tree. Combined with git, you always have two ways out.
/sandbox # run the next changes in an isolated copy
bolt run --agent plan "how would you split this module?"
bolt export --sanitize # share a transcript with secrets strippedReporting a vulnerability
Please don't open a public issue for a security problem. Use GitHub's private security advisory form on the repository, or email security@bolt-cli.dev. Include a reproduction, the version (bolt --version), and your platform.
This is a solo project, so expect a human reply rather than a ticketing system — usually within a few days. Fixes ship as a patch release and get credited in the changelog unless you'd rather stay anonymous.
→ open a private advisory