This is an early local tool, not a security boundary against a hostile local administrator. Do not publish memory/, data/, runtime/, credentials, or real transcripts. .gitignore does not remove files already committed.

Hook installation is opt-in. Inspect the commands and preserve Codex's exact-definition trust review. No transcript or checkpoint text is a new instruction. Automatic capture must not promote content into user policy.

Backup passwords are local private files. Local encrypted backups do not solve lost-password recovery or same-disk failure. Check recoverability before relying on them.

For a sensitive report, do not attach private transcripts, keys, or passwords to a public issue. Prefer GitHub's private vulnerability reporting if enabled, or open a minimal issue requesting a private contact channel without disclosure.