Aider is a chat in your terminal that edits the files in your Git repository. You add files to the conversation, describe the change, and it sends the relevant code to a model, applies the edits it gets back, and commits them with a descriptive message, so every AI change is one git revert away. A repository map, built with tree-sitter, gives the model a compressed view of the whole code base so it can find the right place to edit in larger projects.
It was the first widely used terminal coding agent, and its public leaderboards of how well each model edits code are still quoted when a new model lands. It talks to almost any model through LiteLLM, cloud or local, and adds linting and test runs after each edit, voice input, and a watch mode that picks up instructions left as comments in your editor. The project is Apache-2.0, written in Python, and led by Paul Gauthier with 182 contributors; releases have slowed, with the latest, v0.86.0, from August 2025.
- Repository: github.com/Aider-AI/aider
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Python. Stars: 49.2K. Forks: 5,000. Last push: May 22, 2026.
- Scan: safe, May 22, 2026, commit 5dc9490
Who it is for
Developers who want a model editing their code with Git as the safety net, people who switch between cloud and local models, and anyone who prefers a small, readable tool to a full IDE agent.
Getting started
1. Install the installer, which sets aider up in its own Python environment
python -m pip install aider-install && aider-install2. Start it in your project with a model and key (DeepSeek here; sonnet with anthropic=<key> or o3-mini with openai=<key> work the same way)
cd /to/your/project && aider --model deepseek --api-key deepseek=<key>Safety scan
We cloned Aider-AI/aider at commit 5dc9490 on May 22, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets and no self-decoding code across about 90,000 lines. The one key in the code, a PostHog project key in aider/analytics.py, is the public write-only kind every analytics client ships. Analytics are opt-in: aider asks about 10 percent of users once, and nothing is sent unless you say yes.
- The four pattern hits are harmless. Two are comments inside aider/website/install.ps1 and install.sh, which are copies of the uv 0.5.9 installer that the aider.chat install page serves; the shell version adds uv to your PATH through your shell profile. The other two are the benchmark harness's Dockerfile and a Docker setup script for the benchmark machine.
- Known advisories: 174 across five pinned requirements files, 9 critical. Aider pins exact versions, so a fresh install gets them. The criticals in LiteLLM concern its proxy server, which aider does not run; NLTK's are in the optional help extra. GitPython 3.1.46 is the one that matters, with more than 20 advisories about option injection and hostile .gitmodules files: aider drives Git in your own repository, so the risk is running it inside a repository you do not trust.
- Ten workflows, none using pull_request_target; none of the 14 third-party actions is pinned to a commit. Licence and contributing guide present; no security policy, Dependabot or CodeQL.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 4 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 2 installer scripts (one edits your shell profile) |
| Committed binaries | None. |
| CI workflows | 10 workflows. None use pull_request_target. 14 of 14 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 33 distinct hosts referenced from source; most often github.com, aider.chat, openrouter.ai, img.shields.io. No URLs to bare IP addresses. |
| Known vulnerabilities | 174 advisories across 200 pinned packages: 9 critical, 86 high, 58 moderate, 20 low, 1 unrated. requirements.txt: 105 packages, 106 advisories; requirements/requirements-browser.txt: 36 packages, 59 advisories; requirements/requirements-dev.txt: 73 packages, 42 advisories; requirements/requirements-help.txt: 81 packages, 94 advisories; requirements/requirements-playwright.txt: 4 packages, 0 advisories. |
| Project hygiene | Has licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (4)
| Where | Rule | Match |
|---|---|---|
| aider/website/install.ps1:446 | download-piped-to-shell | # So if you put a curl | sh for this script in its own "run" step, |
| aider/website/install.sh:1242 | download-piped-to-shell | # So if you put a curl | sh for this script in its own "run" step, |
| benchmark/Dockerfile:43 | download-piped-to-shell (test/example) | RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \ |
| benchmark/install-docker-ubuntu.sh:56 | persistence (test/example) | sudo systemctl enable docker |
Installer scripts (2)
- aider/website/install.ps1, 560 lines; talks to doc.rust-lang.org, docs.microsoft.com, github.com, learn.microsoft.com, opensource.org, www.microsoft.com
- aider/website/install.sh, 1,833 lines, edits your shell profile; talks to fishshell.com, github.com, opensource.org
Worst known vulnerabilities (24 of 174)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-82r6-8w77-94w6 | critical | anyio@4.12.1 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing |
| GHSA-284h-m62q-gf8w | critical | gitpython@3.1.46 | GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any… |
| GHSA-4xpc-pv4p-pm3w | critical | litellm@1.82.3 | LiteLLM: Authentication Bypass via Host Header Injection |
| GHSA-6wvf-77m9-58rm | critical | litellm@1.82.3 | LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint |
| GHSA-jjhc-v7c2-5hh6 | critical | litellm@1.82.3 | LiteLLM: Authentication bypass via OIDC userinfo cache key collision |
| GHSA-r75f-5x8p-qvmc | critical | litellm@1.82.3 | LiteLLM has SQL Injection in Proxy API key verification |
| GHSA-m4rf-3fr8-xwx3 | critical | nltk@3.9.3 | NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841… |
| GHSA-rhp5-r9x4-f5g2 | critical | nltk@3.9.3 | NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution |
| GHSA-x99w-6fgc-pmfw | critical | nltk@3.9.3 | NLTK: Allowlisted pickle loaders still permit code execution in current source |
| GHSA-cq5v-8q36-5273 | high | aiohttp@3.13.3 | AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) |
| GHSA-47fr-3ffg-hgmw | high | click@8.3.1 | |
| GHSA-2f96-g7mh-g2hx | high | gitpython@3.1.46 | GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist |
| GHSA-3f7w-8rr8-f37f | high | gitpython@3.1.46 | GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file over… |
| GHSA-3rp5-jjmw-4wv2 | high | gitpython@3.1.46 | GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE) |
| GHSA-4gmw-gg2m-w46p | high | gitpython@3.1.46 | GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file over… |
| GHSA-6p8h-3wgx-97gf | high | gitpython@3.1.46 | GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone … |
| GHSA-7545-fcxq-7j24 | high | gitpython@3.1.46 | GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repo… |
| GHSA-7833-fr7j-v32q | high | gitpython@3.1.46 | GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigPars… |
| GHSA-8mcc-hrx5-hvxc | high | gitpython@3.1.46 | GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory … |
| GHSA-94p4-4cq8-9g67 | high | gitpython@3.1.46 | GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pg… |
| GHSA-956x-8gvw-wg5v | high | gitpython@3.1.46 | GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwr… |
| GHSA-9rj7-rf2p-w77r | high | gitpython@3.1.46 | GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks |
| GHSA-fjr4-x663-mwxc | high | gitpython@3.1.46 | GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled… |
| GHSA-hmq2-w58f-27jc | high | gitpython@3.1.46 | GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitP… |
By the numbers
| Stars | 49.2K |
|---|---|
| Forks | 5,000 |
| Contributors | 182 |
| Commits | 13.1K |
| Open issues | 1,390 |
| Open pull requests | 511 |
| Releases | 93 |
| Latest release | v0.86.0 |
| Licence | Apache-2.0 |
| Main language | Python |
| Project age | 3 years |
| Last push | May 22, 2026 |
| Tracked files | 685 |
| Lines of code | 90.2K |
| Checkout size | 78 MB |
Lines by language: Python 38.4K, Markdown 24.2K, YAML 17K, CSS 3,534, Shell 2,198, JavaScript 1,851.
Questions
Is Aider free?
Yes. Aider is Apache-2.0 and there is no paid tier or account. You pay only for the model you connect: a hosted model bills per token, which for a long session can add up to a few dollars, while a local model through Ollama or any OpenAI-compatible server costs nothing beyond your hardware.
Can Aider use local models?
Yes. It reaches models through LiteLLM, so Ollama, LM Studio, llama.cpp's server and any OpenAI-compatible endpoint work. Editing whole files reliably is hard for small models, though, and aider's own leaderboards show the gap: a local model that chats well can still fail to produce clean edits, so pick one that scores well there.
How does Aider compare with Claude Code or Codex?
Aider is model-agnostic and deliberately hands-on: you choose which files the model sees and it commits every change to Git. Claude Code and Codex are vendor agents that explore the repository, run commands and loop on their own. Aider costs less per task and surprises you less; the vendor agents take on bigger jobs unattended.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.