Security fixes are applied to the current 0.3.x development line and, after releases begin, to the latest released minor version. The 0.2.x line uses an obsolete Provider protocol configuration and is not supported.

Use GitHub's private vulnerability reporting or security advisory flow for this repository. If that option is unavailable, contact the repository owner through the public GitHub profile and request a private channel. Do not include API keys, private configuration files, or exploit details in a public Issue.

Please include:

• the affected version or commit;
• the operating system and Codex surface;
• a minimal reproduction using dummy credentials and an isolated CODEX_HOME;
• the security impact and files affected;
• whether the issue exposes credentials, changes commands, escapes the intended config path, or breaks rollback.

The project is designed to:

• write only to $CODEX_HOME/config.toml or ~/.codex/config.toml;
• create a backup before replacing an existing configuration;
• reject malformed TOML rather than overwrite it;
• store environment-variable names instead of raw API keys;
• redact API keys from Provider test errors;
• keep the SessionStart hook read-only.

These are design goals, not a guarantee that the software is free of vulnerabilities. Run the plugin only after reviewing its scripts and hook definition.