If you discover a security vulnerability in PandaFilter, please do not open a public GitHub issue.
Report it privately via GitHub's built-in security advisory system: 👉 Open a private security advisory
- Response time: We aim to acknowledge reports within 48 hours
- Disclosure: We follow responsible disclosure practices (90-day embargo)
PandaFilter is a CLI tool that sits between Claude Code and your shell. It:
- Intercepts and rewrites shell commands via a
PreToolUsehook - Reads and compresses tool output via a
PostToolUsehook - Executes commands on your behalf via
panda run
This makes the following attack surfaces especially important:
ccr/src/hook.rs— PostToolUse hook, processes all tool outputccr/src/cmd/run.rs— Executes commands on behalf of Claude Codeccr/src/cmd/rewrite.rs— Rewrites commands before execution (injection risk)ccr/src/main.rs—init()writes hooks into~/.claude/settings.jsonhooks/panda-rewrite.sh/~/.claude/hooks/panda-rewrite.sh— Shell hook that intercepts every Bash tool call in Claude Code
ccr/src/handlers/*.rs— Per-command output filters (parse untrusted command output)ccr/src/session.rs— Session state persistenceccr/src/noise_learner.rs— Learns and persists patterns from command output
Cargo.toml— Dependency manifest.github/workflows/*.yml— Release pipeline (produces signed binaries)
| Pattern | Risk |
|---|---|
Command::new("sh").arg("-c") |
Shell injection via user input |
.env("LD_PRELOAD") |
Library hijacking |
reqwest::, std::net:: |
Unexpected network/exfiltration |
unsafe { |
Bypasses Rust memory safety |
| Hardcoded secrets or tokens | Credential exposure |
| Base64/hex encoded strings | Obfuscation of malicious payloads |
| Time-based conditionals | Logic bombs |
New dependencies added to Cargo.toml must meet:
- Downloads: >10,000 on crates.io
- License: MIT or Apache-2.0 compatible
- Activity: Updated within the last 6 months
- No typosquatting: Manually verified against similar crate names
- Day 0 — Acknowledgment sent to reporter
- Day 7 — Severity and impact assessed
- Day 14 — Patch development begins
- Day 30 — Patch released
- Day 90 — Public disclosure (or earlier if patch is deployed)
Critical vulnerabilities (command injection, data exfiltration) will be fast-tracked.
cargo audit— CVE scanning (runs in CI on every release)cargo clippy— Lints for unsafe patterns- GitHub Dependabot — Automated dependency updates
Last updated: 2026-04-02