Workban

Workban Guard

Everything Workban Guard checks.

Every rule and detector, straight from the code. Rules check every command and file access before it runs. Detectors check every new line after it is written. On top of that comes what the agent reads.

  • 39 rules
  • 33 detectors
  • 7 rules for reads
  • Runs locally

Before it runs

Checks every command and file access. Blocks means the action does not run. Asks means you decide.

File system

  • fs.rm-catastrophicBlocksDeleting or moving /, home, system directories, the project itself or .git; formatting disks (mkfs, dd of=/dev/…, diskutil erase)
  • fs.rm-outsideAsksDeleting, emptying or overwriting outside the project (temp directories excepted)
  • fs.rm-trackedAsksRecursively deleting directories with tracked files or unknown targets (rm -r, rsync --delete, tar --remove-files)
  • fs.find-deleteAsksfind -delete / find -exec rm outside artifact directories

Git

  • git.discard-changesAsksreset --hard/--merge, checkout/restore of files, clean -f, rm -f, stash drop/clear, branch -D/-f/-M
  • git.force-pushBlocksForce push or --mirror to protected branches, deleting protected branches
  • git.force-push-branchAsksForce push (--force-with-lease too) to other branches
  • git.push-deleteAsksDeleting a remote branch, git push --prune
  • git.push-protectedBlocksDirect push to main/master
  • git.no-verifyBlocksBypassing hooks or signing (--no-verify, -n, --no-gpg-sign, HUSKY=0, core.hooksPath)
  • git.amendAskscommit --amend
  • git.history-rewriteAsksfilter-branch, filter-repo, reflog expire/delete, update-ref -d, gc --prune=now
  • git.add-envBlocksgit add of .env, key or credential files
  • git.commit-secretsBlocksgit commit when the changes contain secrets

Database

  • db.destructiveAskssupabase db reset/migration down/storage rm, DROP/TRUNCATE/DROP COLUMN, DELETE/UPDATE without WHERE (by file, redirect or pipe too), prisma migrate reset, drizzle-kit push --force, dropdb, flushall
  • db.remote-destructiveBlocksResetting or deleting a remote database (supabase db reset/migration down --linked, projects delete, backups restore)
  • db.volume-wipeAsksdocker volume rm/prune, compose down -v, compose rm -v, podman system reset, supabase stop --no-backup
  • migration.edit-appliedAsksChanging or deleting existing migration files, supabase migration squash

Secrets

  • secrets.read-envBlocksReading or uploading .env, keys, ~/.ssh, ~/.aws/credentials (Read tool, shell, inline code, curl -F/-T, scp)
  • secrets.env-writeAsksWriting or emptying .env files
  • secrets.write-literalBlocksAn edit that writes a secret literal (API key, token, private key) into code
  • secrets.printBlocksPrinting secrets: env/printenv without a name, echo $TOKEN, gh auth token, supabase projects api-keys, op read, aws secretsmanager, security -w, kubectl get secret -o yaml …

Packages

  • deps.not-foundBlocksPackage does not exist on npm or PyPI (hallucinated, "slopsquatting")
  • deps.typosquatAsksName is 1 to 2 characters away from one of the 5000 most popular packages
  • deps.too-newAsksFirst version is younger than supplyChain.minAgeDays (14 days)
  • deps.low-adoptionAsksFewer than supplyChain.minWeeklyDownloads (500) downloads a week (npm)
  • deps.install-scriptsNotePackage runs scripts on install (preinstall/install/postinstall)
  • deps.deprecatedNotePackage or version is marked deprecated

Deploys and cloud

  • deploy.anyAsksDeploys and releases: vercel --prod/env add, supabase db push/functions deploy/functions delete/config push, gh pr merge/repo edit --visibility, terraform apply, kubectl apply, npm publish …
  • remote.deleteAsksDeleting in cloud services: aws s3 rm/rb/sync --delete, gsutil/gcloud storage rm, rclone purge/sync/delete, gh secret delete/api -X DELETE, vercel rm/env rm/domains rm, fly apps destroy …
  • container.destructiveAsksdocker/podman system/image/container prune, rm/rmi with a $(…) list, compose down --rmi

System and shell

  • net.pipe-to-shellAskscurl/wget straight into a shell or an interpreter
  • sys.privilegedAskssudo/doas, chmod 777, chown -R outside the project
  • sys.persistenceAsksWriting to shell startup files, ~/.ssh, LaunchAgents, /etc/sudoers; crontab, launchctl load
  • shell.unverifiedAsksCannot be checked: eval/source with code created at runtime, unknown output piped into a shell or an interpreter, nested too deep

Self-protection and modes

  • self.protectBlocksChanges to Workban Guard's config, state and installed plugins; wbg mode/approve/allow/trust/pause by the agent
  • self.agent-configAsksChanges to Claude or Codex settings (hooks, permissions), to .git/hooks and .git/config, git config core.fsmonitor/sshCommand
  • mode.plan-readonlyBlocksIn plan mode: edits and changing commands (plan files excepted)
  • mode.autopilot-outsideBlocksIn autopilot: writing outside the project (temp excepted)

After every edit

Checks new lines only, not existing code. The agent fixes an Error before it goes on. A Note stays your call.

Security

  • sec.secret-literalErrorSecret literal in code (API keys, tokens, private keys, service-role JWT, database URL with password)
  • sec.evalErroreval, new Function, vm.runIn… (JS), eval/exec (Python)
  • sec.shell-injectionErrorShell commands from template strings or concatenation, shell: true, shell=True, os.system(f"…")
  • sec.sql-concatErrorSQL from template strings or concatenation instead of parameters
  • sec.xssNotedangerouslySetInnerHTML, innerHTML =, v-html, document.write
  • sec.tls-offErrorTLS verification turned off (rejectUnauthorized: false, verify=False …)
  • sec.cors-wildcardNoteCORS for all origins (*)
  • sec.weak-randomNoteMath.random() for tokens, passwords, IDs
  • sec.weak-hashErrorMD5/SHA-1 for passwords
  • sec.cookie-flagsNoteCookie without httpOnly/secure
  • sec.debug-prodNoteDebug mode in production configuration
  • sec.open-ingressNote0.0.0.0/0 or ::/0 in infrastructure configuration

Supabase

  • supa.service-role-clientErrorService-role key in client code
  • supa.rls-missingErrorMigration creates a table without ENABLE ROW LEVEL SECURITY
  • supa.get-session-authNotegetSession() for authorization in server or edge code instead of getUser()
  • supa.public-bucketNotePublic storage bucket

Personal data

  • pii.emailNoteEmail address that can belong to a real person, in code or test data
  • pii.ibanNoteIBAN with a valid check digit; well-known sample numbers stay out
  • pii.cardNoteCard number with a valid check digit; well-known test numbers stay out

Code quality

  • slop.ts-anyErrorany in TypeScript (annotation, as any, <any>, any[])
  • slop.ts-suppressError@ts-ignore, @ts-nocheck, @ts-expect-error without a reason
  • slop.lint-disableErroreslint-disable, # noqa, # type: ignore, swiftlint:disable, //nolint, @Suppress
  • slop.todo-no-issueNoteTODO/FIXME without an issue reference (#123)
  • slop.placeholderErrorPlaceholder instead of an implementation ("implementation here", "not implemented", todo!())
  • slop.empty-catchErrorEmpty catch, .catch(() => {}), except: pass
  • slop.console-logNoteconsole.log/console.debug in production code
  • slop.commented-codeNoteThree or more commented-out lines of code in a row
  • slop.test-focusError.only, .skip, fit, xit, @pytest.mark.skip, @Disabled in tests
  • slop.test-tautologyErrorAssertions that always pass (expect(true).toBe(true))
  • slop.test-no-assertNoteTest file with tests but no assertion
  • slop.file-sizeNoteCode file grows past 300 lines
  • slop.kotlin-bangNote!! in Kotlin production code
  • wbg.suppression-addedNoteNew wbg-ignore suppression (shows up in the review)

After a read

Checks files, command output, web pages and MCP answers. The text has already been read by then, so nothing blocks here: the agent and the user get a note.

Prompt injection

  • inject.overrideNoteAsks to ignore earlier instructions
  • inject.personaNoteGives the agent a new role or new system instructions
  • inject.agent-addressNoteSpeaks to AI agents directly and gives them a task
  • inject.concealNoteAsks to keep something from the user
  • inject.exfiltrateNoteContains an order to send secrets out
  • inject.role-markerNotePoses as the system or a tool with a chat protocol's control tokens
  • inject.hidden-textNoteHides text in invisible characters or reverses the reading direction

Try it with your next task.

Workban is free. Your workspace is ready in a minute, and the first task appears as soon as your agent gets going. The app itself speaks German for now.