Security Documentation Index
June 17, 2026 ยท View on GitHub
Complete guide to VT Code's security documentation.
Quick Start
New to VT Code Security? Start here:
- Security Model - Complete security architecture
Core Documentation
For Users
- Security features overview
- Configuration instructions
- Best practices
- Incident response
For Developers
- Complete security architecture
- Defense-in-depth layers
- Threat model
- Adding new commands safely
- Security testing procedures
- Web fetch security policies
For Organizations
- Command execution policies
- Approval workflows
- Policy configuration
Security Features by Layer
Layer 1: Command Allowlist
- Location:
vtcode-core/src/execpolicy/mod.rs - Documentation: Security Model - Layer 1
- Only 9 commands allowed: ls, cat, cp, head, printenv, pwd, rg, sed, which
Layer 2: Argument Validation
- Location:
vtcode-core/src/execpolicy/mod.rs - Documentation: Security Model - Layer 2
- Per-command validators: Explicit flag allowlists, execution flag blocking
Layer 3: Workspace Isolation
- Location:
vtcode-core/src/execpolicy/mod.rs - Documentation: Security Model - Layer 3
- Path validation: Normalization, symlink resolution, boundary checks
Layer 4: Sandbox Integration
- Location:
vtcode-core/src/sandbox/,vtcode-core/src/tools/bash_tool.rs - Documentation: Security Guide - Sandbox
- Anthropic sandbox: Filesystem isolation, network allowlist
Layer 5: Human-in-the-Loop
- Location:
src/agent/runloop/unified/tool_routing.rs - Documentation: Security Guide - Approval System
- Three-tier approval: Once, Session, Permanent
Configuration
Tool Policy
- File:
~/.config/vtcode/tool_policy.toml - Documentation: Tool Policies
Workspace Configuration
- File:
vtcode.toml - Documentation: Configuration Guide
Sandbox Configuration
- File:
vtcode.toml(sandbox section) - Documentation: Security Guide - Sandbox
Reporting Security Issues
Responsible Disclosure
- Do Not Disclose Publicly - Report privately first
- GitHub Security Advisory - Use GitHub's security advisory feature
- Provide Details - Include reproduction steps
- Coordinate Disclosure - Allow time for fix
Contact
- GitHub: Security Advisories
- Email: See GitHub profile
Documentation Version: 1.0 Last Updated: October 25, 2025 Security Model Version: 1.0