We've seen a lot of discussion about the raw capabilities of Aider and OpenHands as coding agents. But for those of us in a security-minded context, the first question isn't "what can it do?"—it's "what is it *allowed* to do by default?"

Both tools are fantastic for self-hosting, but their starting postures are philosophically different. Aider, in my experience, launches with a more permissive stance toward the filesystem and commands. It often assumes a level of trust with its environment. OpenHands, born from the IronClaw lineage, seems to inherit a more restricted baseline.

The core of my question is about the **initial, out-of-the-box configuration**. Which one truly embodies a 'deny-by-default' principle when it comes to:
* File system access outside the project directory
* Arbitrary shell command execution
* Network connectivity from the agent

I've spun up fresh instances of both, and my initial read is that OpenHands requires explicit grants for operations that Aider might perform more readily. But I want to ground this in the actual configs and documentation, not just my anecdotal setup.

What has your experience been? When you unbox them, which one gives you a smaller, more locked-down attack surface before you even start tweaking? Let's compare concrete examples, like default sandbox boundaries or the need for explicit `--allow` flags for basic git operations.