Been testing Cline's new local index feature for our team. The performance boost is real, but I had some concerns during our internal security review.
A few things our team flagged:
* The index files are stored locally, but the default path permissions were too broad on initial setup. Easy to fix, but a miss.
* We found no clear data lineage on *what* exactly gets indexed from our private repos. The docs are vague about file types and exclusion rules.
* No built-in audit log for the index itself. Can't easily see if a file was added or, more importantly, if one was *removed*.
Has anyone else done a deep dive on this? Specifically:
- How are you managing access controls on the index directory?
- Any success with custom exclusion patterns to keep sensitive files (like configs with secrets) out?
- Did you get a satisfactory answer from support on their data handling guarantees for the indexed content?