Bypass Mode Belongs In A Sandbox
No-questions mode is handing a first-day junior the office keys, the company stamp, and the bank account — the docs restrict it to isolated environments for a reason. On a rented server it's how a database disappears 'with no undo': GitHub restores your code, never your data.
Why it works
Bypass mode — no questions, no diffs, no confirmation — is handing a first-day junior the office keys, the company stamp, and the bank account. The docs restrict it to isolated environments for exactly one reason: on a machine that matters, its worst case is unrecoverable. GitHub restores code; nothing restores a production database an agent dropped 'confidently'.
How to do it
- The standing rule: bypass never runs on your laptop or any production server.
- Feeling slowed down? The legitimate speed path is accept-edits mode plus plan mode — most of the speed, none of the blast radius.
- The legitimate bypass home: an isolated VM, container, or throwaway sandbox where total loss costs nothing.
- Before enabling it even there, inventory: what credentials and connectors does this environment hold?
- On rented servers, enforce with credentials too (scoped keys) — modes are a layer, not the whole defense.
- Leaving bypass on 'temporarily' is how it becomes permanent: turn it off when the experiment ends.
Copy this
prompt
Before we go faster: list what could go irreversibly wrong in this environment if you acted without confirmations — what has no undo here? Then recommend the safest permission mode that still unblocks the work.
What to watch for
- The failure mode isn't malice, it's confidence: bypass removes the checkpoint where wrong-but-plausible gets caught.
- 'It's been fine for weeks' is survivorship, not safety — the mode's cost structure is zero, zero, zero, catastrophic.
Sources
Original: conon.aiDocumentation: code.claude.com