fix: address Codex security audit findings (v2)#64

Merged

sheeki03 merged 10 commits intomainfrom

fix/codex-security-audit-v2

Mar 21, 2026

Commits on Mar 21, 2026

fix: handle Cmd caret escapes inside double quotes + redact env values in findings

sheeki03
and
claude
committed
fix: remove inline TIRITH=0 paste bypass + escape blocked content preview

sheeki03
and
claude
committed
fix: analyze guarded JSON-RPC notifications instead of forwarding blindly

sheeki03
and
claude
committed
fix: harden inline bypass parsing and remove self-invocation guard

sheeki03
and
claude
committed
fix: add SSRF protection to cloaking fetch with DNS resolution checks

sheeki03
and
claude
committed
fix: extract URLs from env-prefix assignments + cap MCP scan file count

sheeki03
and
claude
committed
fix: redact secrets in JSON output + quote shell metacharacters in init

sheeki03
and
claude
committed
style: add HostResolver type alias to fix clippy type_complexity

sheeki03
and
claude
committed
fix: Windows CI test + update rustls-webpki for RUSTSEC-2026-0049
sheeki03
committed
fix: use APPDATA for Windows data_dir + ignore RUSTSEC-2026-0049 for 0.101.x
sheeki03
committed