Your keys and private files stay yours
Saved keys move into your Keychain, commands run in a sandbox without them, and the agent never opens your SSH keys, browser profiles or saved sign-ins.
Keys in the Keychain
The first time this version starts, the provider keys Bandicot saved move into your Mac's Keychain and their old files are removed. Disconnect now forgets everything Bandicot held for that account.
Commands run without your saved keys in their environment, and a key that turns up in a command's output is masked before the agent or your history sees it.
A sandbox by default
Commands now run in a sandbox that can change files only in the open project and the usual build caches. When it stops one, Bandicot shows the whole command and asks once: run it once outside, or keep it inside. Nothing is remembered, so the next command is sandboxed again.
Reading a folder outside the project asks first and names the folder.
Private places stay closed
The agent cannot open your SSH, cloud and package keys, your browser profiles or Bandicot's own secrets, even through a link in the project. It can read the skills and instructions in ~/.claude, but never change them.
Web reads never reach your home network, unless you type that address in your own message.
Plugins, sign-ins and your Macs
A plugin whose files change after you approved it stays off, and says what changed, until you review it again. Sign-ins in the agent's own browser are saved encrypted.
Your Macs shows when each Mac was last seen and lets you remove one, and one switch, Let my other devices reach this Mac, decides whether they reach it at all.