# Coding agent security (Early Access) > For AI agents: a documentation index is available at [/docs/llms.txt](/docs/llms.txt). Append `.md` to any page URL for markdown, or send `Accept: text/markdown`. Wave uses GitHub and coding agents to give Opportunities rich product context: how features behave, where bugs live, and what an implementation should change. That access follows a strict isolation model so agents can investigate and open pull requests without exposing credentials or retaining your source code. Use this page when you need the security and data-handling details behind connecting repositories and running coding agents. For how to connect repositories, go to [Connect context](https://amplitude.com/docs/wave/connecting-context). For broader Amplitude AI privacy controls, go to [Privacy and Security](https://amplitude.com/docs/amplitude-ai/privacy-and-security). ## Why GitHub and coding agents matter Opportunities need accurate product and implementation context to plan work and investigate bugs. Amplitude provides that context through three components: 1. **Code indexing**: Builds markdown context that describes your feature behavior and events for agents across your organization. 2. **Coding agent for targeted questions**: Runs read-only investigation inside a secure sandbox when Wave needs code-based answers. 3. **Coding agent for implementation**: Uses the same sandbox model to implement a plan on your codebase and open a pull request for review. ## Code indexing Code indexing produces a markdown file that describes how your features and events work. Amplitude stores that index in an AWS knowledge base inside your organization's own partition. The partition is single-tenant: Amplitude never shares it across customers. Indexing is: - **Read-only** against your repositories. - **User-controlled**: your users run indexing on demand and refresh it by running it again. - **Scoped to your organization**: Amplitude doesn't use or inspect the index outside your organization's context. - **Fully visible** to your organization, and Amplitude doesn't keep it after you delete it. A typical index takes roughly five to thirty minutes per repository. ## Coding agent for targeted questions As Wave generates opportunities, the Wave agent can start coding subagents that run in secure, network-isolated sandboxes. That code-based investigation improves plan quality and evidence. When the task is a question rather than a change, Amplitude removes write tools from the run entirely. The agent stays read-only against your code. If you provide a key for an AI provider, inference stays within your scopes. Amplitude doesn't bill that usage to Amplitude's own accounts or route it through them. ## Coding agent for implementation Implementation runs use the same sandbox setup as targeted questions. When coding agents implement a plan, they work directly on your codebase and open a pull request for your engineering team to review. Nothing merges automatically. Amplitude opens one pull request per repository that actually changed, on its own branch, and checkpoints progress as the run continues. From that point, your build system and review process take over. Amplitude waits for experiment or flag measurement data before returning a verdict on whether the change worked. > **Note:** Repository scope > > The implementation agent's scope is your whole repository. It can modify configuration or CI files when a task genuinely requires it. Branch protection and required reviews on your side are the intended control, not an assumption that the agent stays in a narrow file lane. ## How Amplitude secures the sandboxes Every subagent run, whether a question or an implementation, follows the same isolation model: the piece that can touch your code holds no credentials, and the piece that holds credentials can't touch your code. ### Fresh, disposable environment per run Amplitude creates a separate virtual machine for each run, not a shared container. The environment starts when the run starts, and Amplitude destroys it when the run finishes. Nothing carries over between runs, and Amplitude doesn't retain source code afterward. ### Unprivileged execution The agent runs as a non-root user. It can't escalate permissions and has no cluster identity. ### No standing credentials A separate credential broker holds your GitHub token and AI provider key. The broker adds those credentials to outbound requests server-side. The agent and coordinator never receive the raw credentials. The GitHub token scopes to your installation and expires within the hour, so a run can't act outside your own environment regardless of what a prompt asks it to do. ### Narrow network access The sandbox can only reach GitHub and your AI provider, both through the broker. It can't reach Amplitude's internal systems, cloud infrastructure metadata, or any other customer's environment. ### Tenant separation Amplitude tags every environment to your organization. Every action, including watching a session, sending a follow-up, or cancelling a run, checks that the run belongs to the caller's organization first. A request for another organization's run returns as "not found," not "forbidden," so it can't confirm that another organization's run exists. ### Pre-run checks Amplitude refuses a run before creating any environment if the target repositories are invalid, span more than one GitHub owner, or the GitHub App installation is unreachable. That prevents a failure from leaving an orphaned or misdirected pull request. ### No silent retries Failed runs don't automatically retry. Amplitude records the failure with output redacted so a credential can't leak into a log line, then waits for a person to decide whether to try again. ## What Amplitude stores Amplitude doesn't store anything from these components except the Wave code indexing output: the markdown context that describes how your features and events work. That index is: - Fully visible to your organization at all times. - Stored single-tenant, within your organization's own partition. - Controlled entirely by your users (created, refreshed, and deleted on your terms). - Not persisted after you delete it. Everything else, including prompts, model responses, and source code read during a sandbox run, isn't retained or logged. The only other record Amplitude keeps is the working history on the opportunity itself: branch name, pull request link and status, diff size, CI status, and a replayable session transcript. None of that is a copy of your codebase. ## Cursor as an alternative provider Amplitude also supports launching coding work through Cursor instead of Amplitude's own agent. Cursor runs execute entirely on Cursor's infrastructure under your organization's own agreement with Cursor. The sandbox and credential-broker model on this page describes Amplitude's own agent specifically.