Roo Code

US CLOUD Act exposureOpen sourceApache-2.0

STAV REVIEW · LAST REVIEWED 06/21/2026

“Permanently shut down with 11 unpatched CVEs including a critical command-injection flaw — no patch is ever coming, migration is the only call.”

Good for

Teams auditing what their developers have installed, to build a removal and migration case
Organisations evaluating community forks (Kilo Code, ZooCode) that descend from this Apache-2.0 codebase
Security teams using the archived v3.54.0 source as a reference for the CVE-2025-58371 attack surface

Watch out for

The VS Code Marketplace listing is still publicly installable at v3.54.0 and growing (+25,000 installs in a single week as of June 2026) — developers may add it without realising the vendor is dissolved
All 11 GHSA advisories are permanently unresolvable: one critical command-injection CVE and seven high-severity RCE variants will never receive a patch
The privacy policy URL now serves an unrelated product's marketing page; every data-handling commitment Roo Code ever made is unverifiable from any surviving source
Zero Stav platform usage across 60 days and a confirmed avoid trust tier — new approvals must be blocked and any active installs migrated immediately

Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.

MODEL REQUIREMENTS

What Roo Code needs from a model.

Required

Streaming
Tool calling

Recommended

Code-native
Long context (≥128k)

Known issues3 open

Public security, privacy and governance advisories that are still open. Each row carries a source link — these are factual claims, not editorial judgements.

2026-05-19

lowUpstream change on roo-code: github_release 'v3.53.0' → 'v3.54.0', github_last_push '2026-05-12T06:18:58Z' → '2026-05-15T18:08:47Z'

other · open

Source ↗

2026-05-12

lowUpstream change on roo-code: github_last_push '2026-05-04T19:52:43Z' → '2026-05-12T06:18:58Z'

other · open

Source ↗

2026-05-05

lowUpstream change on roo-code: github_release None → 'v3.53.0', github_last_push None → '2026-05-04T19:52:43Z', cve_count None → 11

other · open

Source ↗

Data flow & telemetry

How Roo Code moves data between the client, the inference endpoint and any vendor-owned services.

Data flow

Direction: local_only
Stores prompts: No

Telemetry

Collects telemetry: false
Privacy policy: https://roocode.com/privacy

Vendor & licensing

Roo Code

What Roo Code needs from a model.

Data flow

Telemetry

Security profile

Maintenance health

Popularity

Where Roo Code shows up on Stav.

What teams using Roo Code configure.