Mcode executes coding-agent actions and therefore treats filesystem, shell, network, MCP, extension, and remote-host boundaries as security-sensitive.
Do not include credentials, private repositories, exploit payloads against third parties, or sensitive logs in a public issue. Once the project is published on a forge, use its private security-advisory channel. Until a public project location and maintainer contact are selected, retain the report privately rather than opening a public ticket.
The repository is pre-release software. No published version is currently declared supported for security updates. This section must be replaced with a supported-version table before the first public release.
- Codex app-server uses local stdio; network listeners are not enabled by default.
- Mcode exposes ChatGPT-managed OAuth and does not place API keys in its user-facing flow.
- Codex account data lives under Mcode's isolated user-data directory.
- The renderer receives display-safe state, never OAuth credentials.
- Command, file, network, permission, user-input, and MCP elicitation requests retain distinct protocol payloads and UI.
- File paths are resolved inside open workspace roots before navigation or context inclusion.
- Extensions and runtimes are checksum-pinned and license-reviewed before bundling.
- Remote SSH credentials remain with the SSH implementation and operating system; Mcode must not log them.
- Release secrets for signing/notarization must live only in protected CI secret stores.
See docs/ARCHITECTURE.md, docs/CODEX_RUNTIME.md, docs/EXTENSIONS.md, and docs/REMOTE_SSH.md for detailed trust boundaries.