Skip to main content
Report bugs and request features through GitHub Issues. Only invited collaborators can open pull requests.

​
Open an issue instead of a pull request

Detection rules, configuration changes, documentation corrections, and small bug fixes all start with an issue, and an accepted proposal does not authorize a pull request by itself. The maintainer implements fixes with coding agents, so a detailed issue with reproduction steps resolves a problem faster than an unsolicited patch. CC Safety Net has one focus, preventing coding agents from making accidental mistakes that cause data loss, such as rm -rf ~/ or git reset --hard. It is not a general security-hardening or attack-prevention tool.

​
Report a bug

Coding agents write most issues. AGENTS.md in the source repository tells an agent to read CONTRIBUTING.md before filing an issue. Whether you are an agent or a person, follow these rules:
  • Search existing issues first (gh issue list --search "<keywords>" --state all). If someone has already reported the problem, add new evidence to that issue instead of opening another.
  • Report one problem per issue.
  • Reproduce the problem on the latest release. Only describe a reproduction you ran. If you could not run it, say so.
  • Lead with the problem and the evidence: what you did, what you expected, and what happened. Keep the report short.
  • Include your CC Safety Net version, operating system, coding agent or CLI and its version, and how you installed CC Safety Net. npx cc-safety-net doctor --json covers most of this and shows whether custom rules are in play.
  • Root-cause analysis is welcome. Put it after the evidence and label it as a hypothesis unless a test or a trace confirms it.
  • Do not attach a patch or diff. Describe the fix you suggest in prose.
  • Have the person you are working for review the issue before you submit it.
For an incorrect command decision, such as an allowed destructive command or a blocked safe one, also include:
  • The full command, including the whole chain, not just the segment that matched.
  • The working directory and the safety level.
  • The output of npx cc-safety-net explain --cwd <dir> "<command>".
  • For a block that already happened, the entry from npx cc-safety-net logs (npx cc-safety-net logs --id <id> --json).
  • Why the decision should have been different.
A missed destructive command is a public bug, not a vulnerability. The security policy covers the few issues that must be reported privately. Before you submit, read Before you share a trace. Replace private directory names with <project> and ~. Keep the path structure intact so the command still reproduces.

​
Request a feature

Explain the problem you need to solve, the behavior you want, and a concrete example of where it would help. The rules above apply: search first, one request per issue, and no patches.

​
Develop CC Safety Net

Development setup, the bun run check gate, local plugin testing, code conventions, and the pull request process for invited collaborators are in CONTRIBUTING.md in the source repository.
Last modified on October 22, 2026