Secure a Goose Built App Before Launch

Before launching a Goose built app, review what data entered the Block agent, protect its extensions config and .goosehints file, verify dependencies the agent added, scan for committed secrets and collect independent launch evidence. Goose is the open source agent from Block and uses a YAML extensions map rather than a mcpServers key. It accelerates implementation but does not verify the runtime security of what it helped create.

The vibe coding security guide separates generated code from the controls that enforce what it may do. The same split applies here. A prompt such as do not deploy states intent. A missing production credential enforces it. This checklist walks through the app level review for a Goose workflow without assuming the agent caused every defect.

Review area	Evidence to collect before launch
Data handling	Approved data classes, current Goose settings and a record of any sensitive prompt or terminal output
Config and extensions	Reviewed ~/.config/goose/config.yaml extensions and .goosehints owners
Secrets	Clean tree, scanned credentials, rotated keys and headers kept in env not literal strings
Dependencies	Resolved lockfile, package identity, advisory result and install script decision
Application controls	Negative authorization, tenant boundary and input validation tests
Release evidence	Deployed surface checks, known limitations, owner and a fresh retest after fixes

1. Review what data entered Goose

Goose runs in the terminal and can read files, run commands and call connected extensions. List the repositories, files, prompts, terminal output, database samples and logs that developers exposed to it. Classify each item using the same rules that govern other development services. The Goose extension documentation covers agent capabilities and data flow. Confirm the current settings before relying on any default.

That is a data handling review, not an application security result. Do not pipe production secrets, customer records, private keys or unrestricted database exports into a terminal merely because the agent runs locally. Keep live secrets outside the working tree. Use placeholders and synthetic fixtures for examples. If a credential may have entered any unapproved path, rotate it and check use logs. The OWASP secrets management guidance applies to any data that crosses a trust boundary, including a local terminal session.

2. Protect the extensions config and hints

Goose stores extension configuration in ~/.config/goose/config.yaml under an extensions key. The extensions map is a nested YAML structure, not a mcpServers key. A local extension uses type stdio with cmd and args fields. A remote extension uses type streamable_http with uri and headers fields. Goose does not use a rules file. Project specific instructions live in a .goosehints file in the project root. The Model Context Protocol specification defines how these extensions expose tools.

Treat every config and hints file as policy bearing code. Review which extensions are enabled, what tools each exposes and what credentials back them. A remote extension with a write action is a different capability from a read only one. Version control .goosehints so the team shares the same project instructions. Keep any headers or credentials in environment variables referenced by the config, never as literal strings in the YAML. Require a security owner for changes to agent configuration.

3. Keep secrets out of the generated tree

Goose can produce code that embeds a real key, token or connection string into a committed file. Run a secret scan across the whole repository before launch. The CWE list of credential handling weaknesses covers hard coded passwords and the broader MITRE CWE database tracks related credential exposure patterns. Do not rely on the agent noticing its own mistake.

Keep live secrets outside the working tree using environment variables or a secrets manager. The headers field in a remote Goose extension can reference a variable instead of storing a literal token. Use placeholders and synthetic fixtures for examples the agent sees. Review the final diff for any new string that resembles a key, token or connection string. If a credential may have been committed, rotate it immediately and check access logs.

4. Verify the resolved dependencies

Goose may add or upgrade packages while implementing a feature. Do not trust the import list at face value. Inspect the final manifest and lockfile, confirm package identity and publisher and review advisory results before installing in an environment with credentials. The OSV.dev database aggregates known vulnerability data across ecosystems and the npm package-lock documentation describes the resolved dependency tree for Node projects.

Review install scripts because a postinstall hook can run arbitrary code at install time. Inspect transitive changes because a new direct dependency can pull in dozens of unseen packages. Pin references to exact versions or hashes where practical. A dependency that passes an advisory check today can drift when a maintainer publishes a new version, so record the resolved versions and recheck before each release. If the agent added a package you do not recognize, read its documentation and source listing before trusting it with network or file access, because a popular name does not guarantee a safe implementation.

5. Test the application policy, not the generated shape

The generated app can have routes, forms and database queries that compile and render but still fail to enforce authorization. Test the policy directly. Verify a second user is denied access to the first user’s resources. Confirm tenant boundaries hold when two organizations share the same deployment. Check input validation on every endpoint that accepts user data. The OWASP Application Security Verification Standard defines structured requirements for authorization and session controls.

Run negative cases, not just the happy path. A test that confirms a feature works is weaker than a test that confirms an unauthorized request is blocked. Exercise error paths, edge cases and concurrent operations. Generated code often handles the expected flow well and the unexpected flow poorly. Record the negative test results as part of your release evidence so a reviewer can see what was checked, not just what passed. Keep a copy of the test commands, the input data and the observed response for each negative case so the check can be repeated after a fix without re-deriving the scenario from memory.

Why pair Goose with LyraShield

Goose accelerates implementation as the open source agent from Block. LyraShield AI provides release assurance for AI built apps through a loop of target, review, evidence, fix, retest and report. The platform keeps detected candidates, retest outcomes and inconclusive results distinct. Each receipt is limited to its stated evidence and scope, and the assurance record preserves what was checked and the result. Approval gated fix proposals require review before a patch reaches a pull request, so a fix is never automatic.

LyraShield AI is in open beta with open registration. Its runner-local GitHub Action provides an advisory diff gate and SARIF output; it does not create hosted scan or retest evidence. A recorded scan keeps detected findings, retest outcomes and inconclusive results separate. Approval-gated fix proposals still require review and missing verification must remain visible in the release decision.

Use the Goose integration guide: authenticate local stdio separately with npx -y lyrashield@0.2.14 login --oauth and manually merge the pinned @lyrashield/mcp@0.2.12 extension into Goose’s native YAML settings, preserving existing extensions, then read the Goose MCP workflow. Keep configuration instructions in that maintained guide rather than copying credentials between articles. Record the client version, enabled tools, selected workspace and observed connection result. A successful tool listing demonstrates connectivity, not permission to scan every target or execute every write.

Create an account to start a release review or use the free AI app security checklist first. The Claude Code security workflow covers a related terminal agent if your team uses multiple clients.