HN Explorer

Ask HN: How do you keep your setup secure when using harnesses?

1 points by terabytest ↗ HN
Harnesses like Claude Code and Codex have extensive access to the machine you’re running them on and secrets stored there. The risk compounds when you use MCPs or API credentials to have the agent perform tasks on a schedule. If anyone gains access to your account, they can gain access to a huge attack surface. How do you assess these risks and set yourself up to prevent them, while still being able to use harnesses productively?

8 comments

[ 5.5 ms ] story [ 41.0 ms ] thread
aregsar
I have settled on using docker sandboxes sbx which basically sandboxes the agent in a micro vm running on the host and locks down access
salt-licker
I do feel like there’s a usability hole in available options, so I built this open source product to automatically sandbox my agents. Has a secure credential proxy, automatic git checkout in each workspace, file editor + diff viewer built in. Would love to hear your feedback if you try it out: https://yaac.dev/
[deleted]
(comment deleted)