Thanks for helping improve Codex Security. We welcome bug reports, feature requests, documentation corrections, and feedback from open-source maintainers.
Codex Security is developed in OpenAI's canonical repository and published here through a one-way mirror. We can't import pull requests from this repository into the canonical source.
Search existing issues before opening a new one. Maintainers can carry accepted changes into the canonical source or invite a focused pull request for this public repository.
If you maintain an open-source project, open an issue with the repository, your role, and what you need. Support is best effort. Scan only repositories you trust and either own or have permission to assess.
Include your CLI or SDK version, operating system, reproduction steps, and the expected and observed behavior. Remove credentials, private code, customer data, and security findings before posting.
Open an issue describing the problem and the workflow you want to support. Documentation corrections and safe examples are welcome.
Report Codex Security vulnerabilities privately as described in SECURITY.md. Do not post vulnerabilities, exploit details, credentials, or sensitive scan results publicly.
If a scan finds a vulnerability in another project, report it to that project's maintainers through their security policy.
Maintainers update package dependencies and the committed lockfile in the canonical repository. The public release workflow installs that locked graph, tests the package, and publishes a verified artifact with npm provenance. GitHub Actions dependencies are maintained separately in this repository.