🔐 Kilo Code Security — Permissions, Sandbox & Hardening

1. Permission rules: allow, ask, deny

{
  "$schema": "https://app.kilo.ai/config.json",
  "permission": {
    "*": "ask",
    "read": "allow",
    "bash": { "*": "ask", "git status *": "allow", "rm *": "deny" },
    "edit": { "*": "ask", "*.md": "allow" }
  }
}

• The last matching rule wins. Put the catch-all "*" first and exceptions after it. A catch-all placed last overrides everything before it.
• Wildcards: * and ?; ~ and $HOME expand. Use external_directory rules for paths outside the project.
• The same rules can be set per agent in Markdown agent files, which is how you give a review-only agent no edit rights. JetBrains and VS Code have an Auto-Approve settings screen for the same thing.

2. The sandbox (off by default)

// ~/.config/kilo/kilo.jsonc
{
  "sandbox": {
    "enabled": true,
    "network": "deny",
    "allowed_hosts": ["github.com:443", "api.github.com:443"],
    "writable_paths": ["~/shared-output"]
  }
}

• It limits writes to allowed locations and blocks outbound network from model-originated commands, except the hosts you list. It doesn't limit reads: the agent can still read anything your account can.
• macOS and Linux only; not available on Windows. If a policy can't be enforced, Kilo refuses to run the tool rather than falling back silently.
• Only global config can add hosts or writable paths. A project config can tighten the sandbox but not loosen it, so a cloned repository can't open itself up.
• Turn it on when running unfamiliar commands, installing dependencies, working in an untrusted repository, or handling content that could carry prompt injection.

3. Where your code and prompts go

• Kilo Gateway (when signed in): requests go through Kilo to the model provider.
• BYOK / direct providers: to the provider you configured. Log out of the Gateway to make sure nothing routes through Kilo.
• kilo-auto/free and free models may log your prompts, including NVIDIA's free trial endpoints. Don't use them on confidential code.
• Background tasks (titles, commit messages) use the small model, which may go through the Gateway unless you set small_model on your own provider.

Hardening checklist

1. Set "permission": { "*": "ask" } globally and allow-list only routine commands (git status *, your test runner).
2. Deny destructive commands explicitly (rm *, git push --force*).
3. Enable the sandbox on macOS/Linux with network: "deny" and only the hosts you need.
4. Keep keys in environment variables ({env:VAR}), never in a project kilo.jsonc you commit.
5. Avoid Auto Free and free models on proprietary code.
6. Review what cloud agents and Slack can reach: they act on connected repositories and can open pull requests.
7. Update deliberately. Pin a version by installing a .vsix and disabling auto-update if you need to control it.

Source is public at github.com/Kilo-Org/kilocode (MIT). Cross-platform guidance: Security centre.