auto-reasoning is pre-1.0. Security fixes are applied to the latest published 0.x release.
| Version | Supported |
|---|---|
0.1.x |
✅ |
< 0.1 |
❌ |
Please do not report security vulnerabilities through public GitHub issues.
Instead, report them privately through GitHub's
Report a vulnerability flow (Security →
Advisories), or email alanytucho@gmail.com with the subject line auto-reasoning security.
Please include:
- A description of the issue and its impact.
- Steps to reproduce (a minimal proof of concept, if possible).
- Affected version(s) and environment.
- Acknowledgement of your report within 5 business days.
- An assessment and, where warranted, a fix and coordinated disclosure.
- Credit for the report, if you would like it.
auto-reasoning shells out to external tools (e.g. Codex CLI) and calls remote APIs (e.g. the OpenAI Responses API).
Treat prompts, verifier commands, and adapter configuration as trusted input — do not pass untrusted, unsanitized
strings as shell verifier commands, since they run in a shell. Never commit API keys; supply them via environment
variables such as OPENAI_API_KEY.