0–5 min: task and repo scope
Name the task class, repository, allowed paths, denied paths, and owner.
Success checkThe agent has a narrow workspace boundary.
Workstation security baseline · Updated 2026-06-27
Local AI Workstation Security Baseline: Secrets, Caches, Browser Profiles, Package Managers, Agent Logs, and Clean-room Repos
A practical baseline for developers running Claude Code, Codex CLI, local agent tools, mise, uv, browser automation, and repository workspaces without leaking secrets or unsafe local state.
Agentic coding governance often starts at the repository, but the real blast radius begins on the developer workstation. Local files, shell history, package caches, browser profiles, MCP tokens, uncommitted changes, private datasets, and agent logs can all become part of an agent run unless the workstation is prepared.
This baseline connects gstack-style workstation setup, Claude Code, OpenAI Codex CLI, mise, uv, and security-oriented tools such as SkillSpector into one operating model: create clean-room repositories for agent work, keep secrets out of the workspace, separate browser profiles, pin tools, log evidence safely, and reset state after risky tasks.
RepoDaily verdict
Do not treat a personal laptop as a safe default agent sandbox. Before running local coding agents, prepare a clean repository copy, remove unmanaged secrets, isolate browser and tool credentials, pin package-manager and runtime tools, define log retention and redaction, and make every risky agent task disposable or reversible.
Quick matrix
| Surface | Baseline rule | Risk signal | Evidence to keep |
|---|---|---|---|
| Repository workspace | Use clean branch or clean clone for agent tasks | Uncommitted secrets, local patches, data dumps, or ignored files are present | Clean git status, branch name, denied paths |
| Secrets | No real tokens in repo, shell history, env dumps, logs, or prompts | Agent can read `.env`, cloud configs, npm/pip tokens, SSH keys, or prod logs | Redacted secret inventory and rotation owner |
| Browser profile | Use dedicated automation profile for browser/MCP work | Agent shares personal browser sessions, cookies, password manager, or inbox | Profile path, allowed domains, data owner |
| Package managers | Pin uv, Python, Node, pnpm/npm, and release tools with mise or project contract | Agent installs unreviewed tools globally or changes lockfiles unexpectedly | Tool versions, lockfile diff, install log |
| Caches and artifacts | Treat caches, build outputs, downloads, screenshots, and traces as sensitive until reviewed | Agent stores private outputs in persistent cache or shared temp directory | Cache path, retention rule, cleanup proof |
| Agent logs | Store transcripts and command logs with redaction and retention policy | Logs include prompts, file contents, secrets, or customer data | Run ID, redacted transcript, owner, retention date |
| MCP and hooks | Enable one tool/server at a time with owner and scope | Hooks or MCP servers can read files, browsers, tickets, databases, or cloud APIs broadly | Server inventory, scopes, tokens, approval |
| Reset path | Have a cleanup recipe for branches, caches, credentials, browser profile, and generated files | No one knows what the agent left behind | Cleanup checklist and post-run git status |
Workstation readiness scorecard
Score the local environment before giving a coding agent write access.
| Control | 0 points | 1 point | 2 points | Owner question |
|---|---|---|---|---|
| Clean-room repo | Agent runs in daily workspace | Some cleanup before run | Dedicated clean clone/branch with denied paths | What can the agent see besides the task? |
| Secret boundary | Secrets scattered locally | Some examples and ignores | No unmanaged secrets; rotation path known | Which tokens are visible to the run? |
| Browser isolation | Personal profile shared | Separate profile sometimes | Dedicated automation profile and domain allowlist | What cookies or accounts are exposed? |
| Tool pinning | Global tools unknown | Some versions pinned | mise/project contract pins critical tools | Can another machine reproduce the run? |
| Log hygiene | Transcripts unmanaged | Some manual redaction | Run logs redacted, owned, and retained intentionally | Where do prompts and commands go? |
| Reset and rollback | No cleanup path | Manual cleanup known | Post-run cleanup and rollback checklist exists | How do we return to a safe state? |
30-minute local AI workstation security check
Run this before enabling a local coding agent on a new machine or repository class.
5–10 min: secret and data preflight
Check for `.env`, tokens, local configs, private logs, data dumps, and unrelated uncommitted changes.
Success checkNo unmanaged secret or private data is exposed to the run.
10–16 min: tool and browser isolation
List active hooks, MCP servers, browser profiles, package managers, and external tokens.
Success checkOnly task-required tools are enabled.
16–23 min: reproducibility check
Verify mise/uv/project setup pins, test command, cache paths, and transcript storage.
Success checkAnother clean machine could reproduce the run evidence.
23–30 min: reset plan
Write cleanup steps for branch, generated files, caches, logs, browser profile, and credentials.
Success checkThe team knows how to return to a safe state.
Workstation baseline flow
- Start by classifying the task: read-only explanation, docs/test change, bug fix, browser automation, private data task, release task, or infrastructure task.
- Prepare a clean-room workspace: clean branch or clone, no unmanaged secrets, no private data dumps, no unrelated uncommitted changes, and explicit denied paths.
- Choose the tool surface: terminal agent, browser tool, MCP server, hook, package manager, or release tool. Enable only what the task needs.
- Pin runtimes and package managers with mise/project setup contracts; use uv or project-specific tools without global installs when possible.
- Record where prompts, transcripts, screenshots, traces, build outputs, and caches will be stored and when they will be deleted or retained.
- After the run, inspect git status, generated artifacts, caches, logs, browser profile, and credentials before marking the task done.
Scenario table
| Scenario | Baseline setup | Extra guardrail |
|---|---|---|
| Read-only code explanation | Clean branch, no write commands, transcript retained | Deny secrets and private data paths |
| Small code change with tests | Clean clone, pinned tools, focused test command, normal PR review | No deploy/migration/release tasks allowed |
| Browser-assisted debugging | Dedicated browser profile and allowed local/dev domains | No personal accounts, inbox, password manager, or production admin panel |
| MCP-enabled repository task | One approved MCP server with scoped token and owner | Disable server after run and review external calls |
| Package-manager update | Pinned package manager and lockfile review owner | Block global installs and unexpected lockfile churn |
| Private-data investigation | Prefer read-only sanitized copy or synthetic data | Require data owner and retention decision |
| High-risk infrastructure repo | Read-only or disposable clone first | Senior owner approval for writes and clear rollback path |
Workstation risk checklist
Personal-state leakage
The agent may see more than the repository: browser sessions, shell history, config files, caches, and ignored files can all matter.
Global install drift
Unreviewed global package installs make runs hard to reproduce and can change future tasks silently.
Persistent trace risk
Screenshots, traces, build outputs, logs, and caches can retain private code or data after the task ends.
Overpowered browser profile
A browser tool with a personal profile can access email, admin panels, password managers, and private SaaS sessions.
MCP token sprawl
MCP servers often combine file access with external APIs. Scope and disable them like production integrations.
No reset path
Without cleanup, every agent run leaves behind unknown state that affects the next one.
Baseline implementation patterns
Clean-room repo
Create a fresh clone or worktree for risky agent tasks, and start with clean git status.
Secrets preflight
Scan for `.env`, credential files, cloud configs, logs, and private data before launching the agent.
Dedicated browser profile
Use a separate browser profile for automation, with no personal cookies, password manager, or unrelated sessions.
mise pins the workstation
Use mise to pin runtimes and developer tools so agent and human commands run the same versions.
uv avoids global Python drift
Use uv/project environments for Python tasks instead of relying on whatever global Python happens to exist.
Post-run cleanup
Review git status, generated files, logs, cache paths, browser state, tool tokens, and transcript retention after each risky run.
FAQ
Short answers for teams securing local AI coding workstations.
Is a local coding agent safer than a cloud agent?
Not automatically. Local agents may see workstation files, shell state, browser sessions, caches, and unmanaged secrets unless the environment is prepared.
Should agents use my normal browser profile?
No. Use a dedicated automation profile with limited sessions and approved domains.
Why include package managers in a security baseline?
Package managers can install tools, change lockfiles, run scripts, and alter reproducibility. Pin and review them like part of the agent surface.
What is the minimum safe starting point?
Clean clone, no unmanaged secrets, dedicated browser profile, pinned tools, recorded logs, denied paths, and a cleanup plan.
Related radar
Related RepoDaily briefs
gstack: Garry Tan's Open-Source AI Engineering Toolkit for Claude Code and Beyondgarrytan/gstack · Dataset / Public directoryClaude Code Explained: Agentic Coding in the Terminal, IDE, GitHub, Hooks, Plugins, and MCPanthropics/claude-code · Developer tool / CLIOpenAI Codex CLI Explained: Local Terminal Coding Agent, Sandboxes, Approvals, and Repository Workflowsopenai/codex · Developer tool / CLImise Explained: One Project Setup for Dev Tools, Runtime Versions, Environments, and Tasksjdx/mise · Developer tool / CLIuv Explained: Rust-Fast Python Package, Project, Tool, and Python Version Managementastral-sh/uv · Developer tool / CLISkillSpector: NVIDIA's Security Scanner for AI Agent SkillsNVIDIA/SkillSpector · Security tool
Sources
Feedback
Did this page help you make a decision?
Anonymous feedback helps RepoDaily improve what is actually useful.