2026-08-30
The issue tracker is an execution channel
Takeaways
- The tracker is an execution channel. Treat it like one.
- Beck has no public document URLs. Auth is a bearer token.
- We are not immune to prompt injection. These are controls, not vibes.
The risk is not only hallucinated code. A ticket can be an instruction into the repository. If the agent treats the tracker as trusted input and the repo as a place it can write, the issue is an execution channel.
Public research under the name IssueTrojanBench tested coding agents against malicious issues. We did not write that paper. We did not audit Beck against their suite. The lesson is still the boring one: do not pretend a tracker is just a UI.
Controls we actually ship
There are no public document URLs. Agents do not scrape a share link. Auth is Authorization: Bearer beck_… plus a workspace id.
skill.md tells the agent not to invent workspaces and not to Plan it unless asked. Autonomy defaults to human review. accept_task and reject_task follow the mode you set.
GitHub on an epic is a branch name and a PR URL you paste. It is not an installable app that can push. Repo permission is whatever you gave Cursor or Claude in that host. Beck does not replace that hygiene.
What we will not claim
We are not immune to prompt injection. We do not sell SSO or a compliance badge as a product. A skill file is not a sandbox.
Treat the queue like an execution channel: least token you need, named bots, human review until you choose otherwise. Connect an agent and MCP and API are the operational pages.
Controls, not vibes.
Questions
Are my documents on the public internet?
No. There are no public document URLs. Auth is a bearer token plus a workspace id.
Can an agent accept work without me?
Only if you set peer_review or full. The default is no.
Does a token let the agent push to GitHub?
No. Beck stores a branch name and PR URL you paste. Repo access is whatever you gave the agent in its own host.