Code Guardian 17.2: What Changes for You

After updating to Code Guardian 17.2 (available since 28.09.2026) you will notice three things: some commands that previously passed unchecked will now be rejected. Unnecessary prompts become rarer. And more files count as untested, because only a test that actually runs counts. All three changes are intentional; you do not need to configure anything. One example of a closed gap: the Monitor tool of Claude Code previously bypassed the command checks.

What you should do now:

• When you get a new rejection, read the hint in it — it often names the way that works.
• Expect more untested files; before you change such a file, Code Guardian requires a pin test.
• If you use Codex on Windows, split large changes across several patches.

Which security gaps does Code Guardian 17.2 close?

17.2 closes several ways in which a command bypassed the checks or a risky action went through without review.

• Monitor — which starts commands such as Bash — previously bypassed the command checks; it is now checked in the same way.
• The deletion safeguard — which checks risky delete commands — now also reads the content of launched shell script files, not just the command text. It rejects such a script if it is larger than 64 kilobytes or if it is written and launched in the same command.
• If only the output of a command determines the deletion target — in backticks or in $(…) without quotation marks — Code Guardian now refuses the command, even without recursive deletion and for rmdir, shred and unlink.
• Migration commands for Supabase databases now require the same check report as other database commands that write.
• If you copy a file to a server's home directory without an approved deployment report, Code Guardian now refuses instead of asking.
• The secrets safeguard — which checks for credentials committed by accident — now always checks the whole project when called from a subfolder, instead of only the subfolder.
• SQL is read in the order in which the database client actually reads it — which closes forms that previously went unnoticed.

What this means for you: you now get a rejection instead of an unchecked pass — and it often tells you directly what to do.

Which false alarms are gone?

Several checks used to ask even though there was nothing to fear — these false alarms are gone with 17.2.

• The secrets safeguard no longer asks for git commands that do not commit anything.
• The project fence — which confines changes to the project area — no longer refuses Code Guardian's own working files.
• A heredoc containing umlauts or other special characters no longer asks about the system language when no check depends on it.

What this means for you: in these three cases you no longer get a prompt where one used to appear.

Where does 17.2 deliberately judge more leniently?

17.2 deliberately judges more leniently in three narrowly defined places.

• Deleting your own Python virtual environment under ~/.venvs/<name> is now allowed; the parent folders themselves remain blocked.
• A deployment script that counted as a deployment only because of its name is now read by 17.2. If it contains no transfer and no remote call and starts no further program, it runs without a prompt.
• The exception for throwaway databases now applies only to a fixed list of local default addresses, never over the network.

What this means for you: the relaxations are narrowly scoped: any doubt about the deployment script remains a rejection, and the database exception never applies over the network.

What changes in test coverage?

A file now counts as tested only if a test that actually runs reaches it.

What no longer counts as proof:

• a skipped, commented-out or empty test
• a mere import of the file at the top of a test file, if the imported name is not used in any test that runs

What this means for you: you now see more files as untested — not a new weakness in your code, but a stricter measurement. The characterization gate (the check before a change to untested code) now demands a pin test (a test that records the existing behavior before the change) where it previously let things through.

What else is new?

Two new capabilities concern how Code Guardian itself is checked and how several sessions work together.

• An additional review agent reads a finished diff but cannot run, write or delete anything; its findings count as suspicion until a run proves them. That makes 14 review agents instead of 13.
• When several sessions work on the same project, Code Guardian suggests a task reconciler from three sessions onward — and asks you first. It reconciles open tasks with git at a fixed interval (default 20 minutes, adjustable) and only reads.
• If nobody is available to answer a prompt, you can now set in a configuration file that a prompt from the command safeguards becomes a rejection with an action hint. Without this setting, everything stays as before.

What this means for you: an additional, read-only review agent can now run alongside, and from three sessions onward Code Guardian suggests a task reconciliation.

What changes on Windows?

On Windows, what a check actually costs has now been measured for the first time: a median of about 1.7 seconds before and 0.6 seconds after a Bash command; the total per call is a median of about 2.4 seconds (measured on GitHub windows-latest). The session start additionally measures the program start on your machine. What this means for you: the session start warns you in advance if the time limit is too tight for it.

What changes for Codex users?

For the OpenAI Codex CLI, 17.2 closes its own gaps and makes the Windows check more complete.

• With the Codex default setting, the model could open a console and type commands into it; Codex triggers no check for that, so the typed commands ran unchecked. The installer now switches this route off in your config.toml.
• On Windows, Code Guardian previously did not check individual files in large patches because the command line became too long. Now no file of a patch remains unchecked.
• The time limit for checking a patch previously expired too early or too late depending on the start time; it now ends at the planned time.
• The command safeguards of the Codex output also receive security fixes, for example reading launched shell script files.

What this means for you: on Windows, Code Guardian checks a patch with 10 files in about 24 seconds; from 20 files it stops at the time limit, safely as a rejection. Split large changes into several patches.

Which limits remain open?

These limits remain in 17.2:

• The pattern detection of the security check recognizes forms, not actual exploitability, and does not follow data across function and file boundaries.
• A known false alarm of the deletion safeguard for Python helper functions for temporary test directories remains: a relaxation for it did not pass our own check in four rounds and was withdrawn.
• The migration report announced for 17.2 in the target project on Windows is not yet included; it will come in a later version.
• For test coverage, helper methods and test preparations (fixtures) still do not count as proof, even if a running test calls them; whether a condition really skips a test is not evaluated.

How was 17.2 checked?

Before release, 17.2 went through a test battery — the table shows the numbers.

For context: four levels were added, none was removed, and no verdict changed. Both error directions — a check that triggers rightly, and a check that rightly lets through what is allowed — passed completely.

What does the comparison measurement measure?

An independent comparison measurement tests whether a task turns out differently with Code Guardian than without it. It does not test the technology of the checks, but their effect on the work result.

Status of the comparison measurement: in scenario S1, 17.2 was compared in 10 runs with Code Guardian against 5 runs without Code Guardian. On average the scores were 5.60 against 5.20 — with a p-value of 0.3986, no difference is proven.

Balance across all valid comparisons from v16.116 to 17.2 (8 measurements):

• 4 with a proven difference
• 3 undecidable
• 1 without a proven difference

A run without a proven difference is a result, not a flaw — but not proof that Code Guardian works.

You can find more about the product on the product page.

Frequently asked questions about Code Guardian 17.2

Do I have to write tests immediately for every file that now counts as untested?

No. The characterization gate demands a pin test only when you want to change such a file.

Where do I find the requirements and the configuration?

In the technical documentation at provimedia.de/code-guardian/technik — it lists system requirements, all settings and the update interface.

How do I know that Code Guardian actually helps?

The effect is shown by the comparison measurement in the section above, not by the test battery — the battery only shows that the checks work as intended.

How do I get version 17.2?

The package is in the customer portal. How Code Guardian keeps itself up to date afterwards is explained at provimedia.de/code-guardian/updates.

What do I do if a new rejection stops my usual workflow?

Read the rejection: in many cases it names the way that works, for example in separate steps. Background is given in the technical documentation.

Sources

• Published update guide for version 17.2 (customer portal)
• Verification record for version 17.2 compared with v17.1 (customer portal)

As of: 29.09.2026