Cline github.com/cline/cline ↗

Audit Installation Provenance and Pin a Known-Good Version

The Clinejection incident (Dec 2025 – Feb 2026) showed attackers can publish unauthorized Cline releases to npm and the VS Code Marketplace by hijacking the maintainer publish workflow. Treat the extension as an untrusted dependency.

Setting: VS Code → Extensions → saoudrizwan.claude-dev → "Install Specific Version"; CLI: npm install -g @cline/cli@<pinned-version>.

Tip: pin to a vetted version no earlier than v3.35.0, disable auto-update for the extension, verify the publisher ID matches saoudrizwan, review the GitHub release SHA before bumping.

Keep the Cline Panel and Task History Private

Cline's chat pane renders markdown images inline; loading attacker-controlled URLs is the documented data-exfiltration channel for .env contents. Task history and checkpoint snapshots persist transcripts on disk under .cline/ (workspace) or ~/.cline/data/ (CLI).

Tip: never screen-share the Cline panel with live secrets in scope; periodically purge task history and checkpoint stores; treat them like shell history files.

Disable Auto-Approve; Turn YOLO Mode Off

Cline Settings → Features exposes nine auto-approve toggles plus a YOLO Mode checkbox. There is no fixed allowlist — the model itself decides requires_approval per command, which Mindgard showed can be overridden via .clinerules.

Path: Cline panel → gear icon → Settings → Features → Auto-Approve.

Tip: leave Execute all commands, Edit all files, Read all files, Use the browser, and YOLO Mode off. Permit at most Read project files and Execute safe commands. Set "Max Requests" to a low number (e.g. 20) so a runaway task pauses.

Isolate the Workspace with a DevContainer or Remote SSH Host

Cline executes shell commands and writes files with the privileges of the VS Code process — on a developer laptop, that means full access to ~/.ssh, ~/.aws, browser cookies, and any mounted drives.

Setting: .devcontainer/devcontainer.json with "remoteUser": "vscode", no SSH-agent forwarding, no host volume mounts for ~; or VS Code Remote-SSH to a disposable VM where Cline is installed on the remote host only.

Tip: run Cline inside a container or ephemeral VM with no credentials mounted; never install Cline on a machine that also stores production secrets or signing keys.

Restrict File Access with .clineignore; Lock Down .clinerules

ClineIgnoreController enforces .clineignore (gitignore syntax) to block reads/writes/listings, and .clinerules/ files are injected into the system prompt every task. Mindgard's CVE class abused .clinerules to disable approval gates; Embrace The Red's PoC abused unrestricted reads of .env.

Tip: treat .clinerules/ as security-sensitive — review every file in PRs, never accept rules from untrusted forks, disable rules in the management panel when not in use.

Constrain the Terminal Tool — No Broad Shell Auto-Approval

execute_command runs through VS Code shell integration. The model-assigned requires_approval flag is documented in the system prompt and therefore known to attackers; DNS-exfil via ping $(cat .env) was demonstrated.

Setting: Cline Settings → Features → "Execute safe commands" only; "Execute all commands" off.

Tip: require manual approval for every command in untrusted repos; on Linux/macOS dev VMs, drop egress for the Cline user (firewall rules blocking DNS/HTTP except to allowed LLM/MCP endpoints) to neutralize DNS- and image-based exfiltration.

Protect BYOK Credentials — Keep Keys Out of the Workspace

Cline stores API keys in the VS Code Secrets API (extension storage, encrypted at rest) and the CLI stores them in ~/.cline/data/secrets.json. Project .env files have historically collided with Cline-configured keys (issue #714) and are also the primary exfil target in known PoCs.

Setting: Cline Settings → API Configuration (provider, key); CLI: cline config set.

Tip: enter keys through the Cline settings UI only — never via a workspace .env Cline can read; use scoped, rate-limited, short-lived keys; rotate after any suspected injection; prefer the Cline Provider gateway or an internal LLM gateway.

Vet MCP Servers — Never One-Click Install from the Marketplace

MCP tool descriptions are strings rendered into the LLM context, so a malicious server can inject persistent instructions, shadow legitimate tools, or pivot the agent. Configs live at ~/.cline/mcp.json (CLI) and the IDE Configure tab.

Setting: MCP Servers icon → Configure → JSON; per-server autoApprove: [] array; disabled and timeout fields.

Tip: install MCP servers only from sources you would npm install from in production; keep autoApprove empty; pin server versions; pass secrets via env vars not config literals; review every new tool's description text before first use.

Defend Against Indirect Prompt Injection in Untrusted Content

Cline ingests repo files, docstrings, markdown, web fetches, issue/PR text, and MCP output as plain context. Confirmed attack vectors: malicious Python docstrings, .clinerules overrides, markdown image URLs that exfiltrate via the rendered chat, TOCTOU staging across multiple file edits.

Setting: Cline Settings → Features → "Use the browser" off; review checkpoint diffs before continuing a task.

Tip: when analyzing an unknown repo, start with auto-approve fully off; never let Cline open a PR or issue body from an external contributor without reading it yourself first; rely on checkpoints to roll back and inspect.

Configure Telemetry, Audit Logs, and Enterprise Gateway

Cline ships a pluggable telemetry provider (PostHog by default, with OpenTelemetry and no-op options). Issues #3361 and #7068 document cases where data was transmitted with telemetry "disabled," so verify behavior rather than trusting the toggle. Enterprise deployments can route LLM traffic through the Cline Provider gateway.

Setting: Cline Settings → Advanced → Telemetry (off); enterprise: OpenTelemetry endpoint per enterprise-solutions/monitoring/telemetry docs.

Tip: in regulated environments, set telemetry to no-op and confirm with a network trace; route all provider calls through your own gateway (egress allowlist to that gateway only); ship Cline event logs and command-execution audit trail to your SIEM.