Coder Review

Plans & pricing

Prices last verified Nov 11, 2026

Free plan limits

The Community edition is free under AGPL-3.0, with up to 5 active Coder Agents and 1 platform integration.

Free trial

No free trial

Coder alternatives

7.9/10

GitHub

Code hosting, code review, CI/CD and Copilot on one platform

Freemium

7.5/10

Docker

The most widely used container tooling among developers, now adding tools for AI agents

Freemium

Controversies & incidents

Issues documented by the press, regulators, courts or the vendor itself. Every item is sourced; unproven claims are labelled as allegations. Last researched: Nov 11, 2026

• Medium impactConfirmedSecurity · Oct 1, 2026

  Multiple High and Moderate security advisories in late 2026

  The first page of coder/coder's advisories lists 10 entries published between 27 Oct and 11 Nov 2026, two of them rated High, covering a leaked session token and a temporary database password.

  Read the full account

  According to the project's GitHub advisories page, entries include a session token leaked to arbitrary hosts via the web dashboard for sub-agent external apps (High, 27 Oct 2026), a temporary database password exposed in API errors when using AWS IAM authentication (High, 11 Nov 2026), and several Moderate or Low items. These advisories were published by the project itself; the listing does not describe real-world exploitation or per-item fixes.

  Vendor response

  The project published the advisories itself on GitHub.

  Sources:coder/coder security advisories (GitHub)

• High impactResolvedSecurity · Aug 31, 2026

  Module registry compromised, serving malicious Terraform modules

  Per Coder, a Cloudflare API key was compromised and part of registry.coder.com traffic was redirected to an attacker's server for about 14 hours. Coder says it remediated the issue the same day.

  Read the full account

  Coder says that between 07:35 and 21:45 UTC on 31 Aug 2026 an unauthorized actor used a compromised Cloudflare API key to redirect part of the traffic to a server serving tampered modules designed to collect AWS, GCP and Azure credentials and send them to the domain coder-infra.com. Per BleepingComputer (3 Sep 2026), targeted data included provisioner environment variables, API keys, OIDC tokens and SSH keys, and Coder lacks the attacker's logs so it cannot identify every affected deployment. Coder states its own codebase and Google Cloud infrastructure were not compromised, and that an outside firm, Coalition Incident Response, confirmed its findings on scope. Coder recommends upgrading to patched releases and rotating any potentially exposed credentials.

  Vendor response

  Coder says it fully remediated the issue the same day: it removed the malicious IPs, cleared caches, released patches, published advisory GHSA-vx42-ghc9-gw65 and offered an independent reviewer's report.

  Sources:Coder blog: Registry security incidentBleepingComputer (2026-09-03)

• Medium impactResolvedSecurity · May 19, 2026

  Critical Azure instance identity signature bypass (CVE-2026-46354)

  A GitHub advisory rated critical a flaw allowing unauthenticated theft of agent tokens on templates using Azure instance identity. Patches and a workaround exist.

  Read the full account

  Per advisory GHSA-6x44-w3xg-hqqf, published 19 May 2026, azureidentity.Validate() did not verify the PKCS#7 signature, so anyone who knows a workspace's vmId could retrieve the agent's session token. The advisory notes the vmId is a UUID, which in practice usually requires prior access. The workaround is to switch Azure templates to token authentication; the flaw is fixed in releases 2.33.3, 2.32.2, 2.31.12, 2.30.8, 2.29.13 and 2.24.5.

  Vendor response

  The project published the advisory, patched releases and a workaround.

  Sources:GitHub advisory GHSA-6x44-w3xg-hqqf