I’ve been testing Aider and OpenHands side‑by‑side on a dedicated test box, and I’m genuinely concerned about Aider’s default posture. It feels like handing over root to an untrusted intern—especially if your team just `pip install aider-chat` and run it against a live codebase.

The core issue: Aider defaults to full read/write access to the entire directory it’s launched from (and often the entire git repo). No automatic sandbox, no network restrictions, no permission boundaries. If you give it a repo with sensitive configs or credentials in history, it can propose changes to them. Combine that with overly permissive git settings, and you’re asking for trouble.

What I’m seeing in our test runs:

* Aider will happily `git add` and commit changes to files outside the intended scope if you don’t explicitly constrain it.
* The agent can read any file in the current working directory tree, which might include `.env`, internal keys, or other secrets.
* No built‑in isolation from the broader system. If you let it execute shell commands (via `--shell‑enable`), it runs with your user privileges.

Compare that to OpenHands, which defaults to a restricted workspace and requires explicit volume mounts and command allow‑lists. It’s the difference between “default‑open” and “default‑restricted.”

Here’s a quick example of how I lock down Aider for internal use—this should be the baseline, not an afterthought:

```bash
# Run in a dedicated, empty directory
mkdir /tmp/aider_workspace && cd /tmp/aider_workspace

# Clone only the specific repo you want to work on
git clone https://github.com/your/project.git --depth 1 .

# Explicitly exclude sensitive paths
aider --gitignore-file .gitignore-safe --map-tokens 1000
```

Even then, you need to audit `.gitignore` and set `git` configs like `safe.directory` and `protect` rules.

How are you all handling this? Is anyone running Aider in a container or a dedicated user namespace by default? I’m pushing for our team to adopt a hardened config from day one, but getting pushback that it’s “slower” or “too much setup.”

-- Ray