Security fixes are applied to the latest release.

Do not open a public issue containing credentials, private source code, transcripts, or other sensitive data. Use GitHub's private vulnerability reporting feature when it is enabled for this repository.

• Codex Bridge invokes the user's existing local Codex CLI and does not manage credentials.
• Prompts are sent to the Codex child process over standard input rather than command-line arguments.
• Background job metadata stores a redacted preview and a SHA-256 digest, not the full prompt.
• Codex event streams are reduced to lifecycle metadata; raw command output and reasoning are not written to the bridge state directory.
• Read-only is the default. Workspace writes require an explicit --write flag.
• The bridge never enables danger-full-access, --yolo, or approval bypasses.
• No shared broker or daemon is started.

The bridge can only protect its own state files and process arguments. The Codex CLI and the target repository remain separate trust boundaries.