We take the security and integrity of MCP Codex (mcp-codex.com) and the Model Context Protocol ecosystem seriously.
If you discover a security vulnerability within the MCP Codex web platform or any associated tools, please do not open a public GitHub issue.
Please report security vulnerabilities confidentially via GitHub Private Vulnerability Reporting:
- 🛡️ GitHub Security Advisory: Report a vulnerability
- Alternatively, go to the repository's Security tab and click "Report a vulnerability".
Please do not disclose vulnerabilities via public issues or pull requests.
Please include:
- A detailed description of the vulnerability.
- Steps or a proof-of-concept to reproduce the issue.
- Potential impact on users or infrastructure.
We will acknowledge receipt within 48 hours and work with you on a resolution before public disclosure.
Warning
When using MCP servers on your local machine:
- Never commit secrets: Do not commit configuration files containing live API keys (
GITHUB_PERSONAL_ACCESS_TOKEN, database passwords, Stripe secret keys) to public repositories. - Review Server Permissions: MCP servers with file write or shell execution privileges (
@modelcontextprotocol/server-filesystem,mcp-server-git) should be scoped only to directories you trust. - Use Read-Only Database Roles: When connecting AI agents to production or staging databases, create a dedicated database user with
SELECT-only privileges unless write capability is strictly necessary.