What
Each permission rule forwarded to a cloud session is classified first. Rules that reach outside the project are dropped as rooted, rules that only make sense on your own device are dropped as device, malformed rules as invalid, and rules past the count or length caps as over_cap. The rest are kept.
Details
- Screening walks through wrapper commands (sudo, doas, env, timeout, xargs and others) to find the real command underneath.
- It knows a large table of network-capable commands including curl, wget, ssh, psql, mongosh and invoke-webrequest.
- It also flags arguments that bind a server to any address, such as --host, --bind or HOST= with values like 0.0.0.0, :: or localhost.
- Counts of what was dropped are reported as droppedRooted, droppedDevice, droppedInvalid, droppedOverCap and droppedGuarded.
Evidence
keep_covers_device_tools
Strings lifted out of the shipped bundle, so the claim above can be checked against them.