Skip to content

Fleet Deck

v0.13.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 11d Developer Productivity
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

agents ai-agents claude claude-code claude-code-plugin web
+4 more
developer-tools multi-agent orchestration tmux

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Moderate signal
editorial:auto 11d

Payload capture redacts secret-looking values before disk write; Bearer token is now mandatory over loopback when `FLEETDECK_REQUIRE_TOKEN=on` is enabled.

Why it matters: Redaction mitigates accidental secret exposure; enabling `FLEETDECK_REQUIRE_TOKEN=on` raises authentication severity to high, requiring token handling for all loopback calls.

Summary

AI summary

Breaking change: agents poller no longer uses a shell, requiring executable scripts instead of quoted commands.

Changes in this release

Security High

Payload capture now redacts secret-looking values before disk write.

Payload capture now redacts secret-looking values before disk write.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Security High

Bearer token required even over loopback when `FLEETDECK_REQUIRE_TOKEN=on` is enabled.

Bearer token required even over loopback when `FLEETDECK_REQUIRE_TOKEN=on` is enabled.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Breaking High

Agents poller no longer uses a shell; runs via execFile with argv split on whitespace.

Agents poller no longer uses a shell; runs via execFile with argv split on whitespace.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Full changelog

A supply-chain and shared-host hardening pass, written with scanner triage in mind: the daemon executes no shell anywhere, payload capture actually redacts, and an opt-in mode puts the bearer token in front of loopback too.

Security

  • Payload capture actually redacts now. With FLEETDECK_CAPTURE_PAYLOADS=on, captured hook payloads are scrubbed before they touch disk: values under secret-looking key names, well-known credential shapes (sk-ant-, ghp_/github_pat_, xox?-, AKIA…, JWTs, PEM private-key blocks, Bearer tokens), and the daemon's own bearer token. Free-text secrets can still slip through, so capture stays opt-in and 0600 — the previous "secrets are scrubbed" wording promised more than it did.
  • FLEETDECK_REQUIRE_TOKEN=on — the bearer token even over loopback. Opt-in mode requiring the token on every control/data route even for loopback; /hook/*, /health, and the public board shell stay exempt. Closes the loopback trust zone against other OS users on a shared machine and the residual Host-rewriting reverse-proxy case. The fleet's own hooks/CLI attach the token automatically, so a normal single-user setup is unaffected.
  • The board shell now ships a Content-Security-Policy, and every response carries X-Content-Type-Options: nosniff.
  • Exec-class API routes log who asked (remote address, proxy verdict, unsupervised flag), and the daemon warns at startup when any test-seam env var is live.

Changed

  • BREAKING — the agents poller no longer uses a shell. FLEETDECK_AGENTS_CMD is whitespace-split into argv and run via execFile; quotes, pipes, $() and redirection are never interpreted (the default claude poll is unchanged). An override that leaned on shell features must move into an executable script; false/blank still disables the poller.

Published to npm via OIDC trusted publishing with provenance. Full detail in #9.

Breaking Changes

  • FLEETDECK_AGENTS_CMD no longer invokes a shell; it is whitespace‑split into argv and executed via execFile, breaking any usage of quotes, pipes, $(), or redirection.

Security Fixes

  • Payload capture now properly redacts sensitive values (sk‑ant‑, ghp_, github_pat_, xox?- , AKIA…, JWTs, PEM private keys, Bearer tokens) when FLEETDECK_CAPTURE_PAYLOADS=on.
  • `FLEETDECK_REQUIRE_TOKEN=on` closes the loopback trust zone vulnerability by requiring the bearer token on every control/data route (except exempt endpoints).
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Fleet Deck

Get notified when new releases ship.

Sign up free

About Fleet Deck

All releases →

Related context

Earlier breaking changes

  • v0.6.0 Adds nullable columns `ticket`, `ticket_source`, `prev_callsign` to `sessions` table via schema migration.

Beta — feedback welcome: [email protected]