Codex Auth Router handles OAuth refresh tokens, local router bearer tokens, and Codex configuration files. Please report suspected security issues carefully.

This project is pre-v1. Security fixes are handled on a best-effort basis for the main branch.

If GitHub private vulnerability reporting is enabled for this repository, use the repository's Security tab and "Report a vulnerability" flow.

If private reporting is not available, open a public issue asking for a private security contact path, but do not include exploit steps, account identifiers, refresh tokens, router tokens, redirect URLs with live codes, logs containing credentials, or other sensitive details.

Useful reports include:

• affected command or workflow;
• operating system and install method;
• whether OS keyring or encrypted-file secrets are in use;
• minimal non-sensitive reproduction steps;
• expected and observed behavior.

Security-sensitive areas include OAuth login, token refresh, secret storage, router authentication, Codex config mutation, local control sockets/pipes, and launcher/startup integration.