Aider aider.chat ↗

Local-only Python CLI (Apache-2.0, ~45k stars) that pairs with a remote LLM to apply git-aware diff edits. No built-in network listener (except opt-in --browser GUI), no auth, no sandbox — reads files, scrapes URLs, executes shell/lint/test commands directly. No published CVEs as of writing.

Pin the Version, Isolate the Install

Aider ships rapid PyPI releases — a compromised or buggy release can rewrite your repo on next run. Pin a known-good version rather than tracking latest.

pipx install 'aider-chat==<pinned-version>'
# avoid: aider --upgrade  and  aider --install-main-branch

Tip: pin in requirements.txt/pyproject.toml, review the changelog before bumping; never install via the OS package manager (docs explicitly warn it installs wrong deps).

Network Exposure — CLI Local, Browser Mode Not

Default CLI mode opens no listening ports — outbound HTTPS to LLM provider, PostHog, /web scrapes only. The --browser/--gui mode launches a Streamlit server that binds locally without authentication.

# Do NOT bind GUI to 0.0.0.0
aider --browser    # localhost only

Tip: keep gui: false in .aider.conf.yml; if you need it, leave bound to loopback and gate access via SSH port-forwarding.

Authentication — N/A, Local Trust Model

Aider has no user authentication; whoever runs the binary inherits full repo-edit and shell-exec rights. This section reduces to OS-level controls.

Tip: run Aider as your normal user, never as root, and not from shared service accounts. Treat any host running Aider as a developer-shell-accessible host.

Isolation — No Built-in Sandbox

Aider executes /run, --lint-cmd, --test-cmd, accepted suggest-shell-commands directly on the host with your privileges. Run inside a container scoped to one repo.

docker run --rm -it \
  -v "$PWD":/src -w /src \
  --network=bridge \
  -e ANTHROPIC_API_KEY \
  python:3.12-slim bash -lc 'pip install aider-chat==<pin> && aider'

Tip: one container per project, no host bind-mounts outside the repo, drop capabilities, disable --suggest-shell-commands.

`.aiderignore` and Edit-Scope Control

.aiderignore (gitignore syntax) is the only mechanism that hard-blocks files from being read or edited. Pair with --subtree-only in monorepos and --read for reference-only files.

# .aiderignore
.env*
**/secrets/**
**/*.pem
terraform/**
node_modules/**

# .aider.conf.yml
aiderignore: .aiderignore
subtree-only: true
add-gitignore-files: false

Tip: commit .aiderignore, keep gitignore: true (default), use /read-only for anything that shouldn't be edited.

Credentials — Env Vars or `.env`, Never `.aider.conf.yml`

The YAML config path supports openai-api-key / anthropic-api-key and lives in home or repo root — easy to leak via dotfile sync or git add. Prefer env vars from a secret manager.

export ANTHROPIC_API_KEY="$(op read op://dev/anthropic/key)"
aider --env-file ~/.config/aider/.env

Tip: never set api-keys in .aider.conf.yml; ensure .env and .aider.conf.yml are in your global .gitignore; rotate keys regularly.

`--yes-always` and Auto-Commit Risks

--yes-always bypasses every confirmation — file adds, shell suggestions, URL scrapes, commits. Combined with defaults auto-commits: true + dirty-commits: true, an unattended Aider can rewrite + commit your work in one LLM turn. Architect mode adds auto-accept-architect: true.

# .aider.conf.yml — safer defaults
yes-always: false
auto-commits: true          # revert-friendly per change
dirty-commits: false        # don't sweep up unstaged work
auto-accept-architect: false
suggest-shell-commands: false
git-commit-verify: true     # run pre-commit hooks on aider's commits

Tip: work on a dedicated branch, review every /undo-able commit, only enable --yes-always in CI on a throwaway worktree.

Prompt Injection from Files, Diffs, and Web Pages

Aider feeds the LLM the repo map + every added/read file + /web scrapes + (default detect-urls: true) auto-fetches URLs in your messages. Hostile content in a dependency README, vendored JS, scraped page can pivot the model.

# .aider.conf.yml — reduce injection surface
detect-urls: false          # require explicit /web
disable-playwright: true    # block headless-browser scrapes

Tip: vet files before /add, prefer /read-only for third-party docs, never /web an untrusted URL, read every diff before accepting.

Updates and Telemetry (PostHog)

Aider checks for updates on launch (check-update: true) and sends anonymous usage events to PostHog by default (model names, token counts, errors, command usage — not code or keys).

aider --analytics-disable # writes permanent flag

# .aider.conf.yml
analytics: false
analytics-disable: true
check-update: false
install-main-branch: false

Tip: disable analytics fleet-wide; if you must keep it, redirect to your own PostHog via analytics-posthog-host.

Audit — Chat, Input, and LLM History Files

Aider writes .aider.chat.history.md (full transcripts + diffs), .aider.input.history (every prompt typed), and optional .aider.llm.history (raw LLM traffic) in the repo root. They contain code snippets, file contents, anything pasted.

# .aider.conf.yml — relocate outside repo
input-history-file: ~/.local/state/aider/<repo>/input.history
chat-history-file:  ~/.local/state/aider/<repo>/chat.history.md
llm-history-file:   ~/.local/state/aider/<repo>/llm.history
restore-chat-history: false

Tip: confirm .aider* is in .gitignore (default behavior with gitignore: true); for team audit trails, enable --llm-history-file and ship the JSONL to your SIEM.

References & further reading