Codex Flight Control is a local development control plane. A vulnerability can affect project source, local Git state, plugin-private data, Agent authority or diagnostic privacy even when no remote service is involved.

Before the first public release, only the current main release candidate is maintained. After a public release, this file will name supported version lines and security-fix windows.

Do not include a vulnerability, credential, private repository, Private Skill, database or diagnostic containing user data in a public issue.

When this repository is published on GitHub, use its private Security Advisory reporting channel. Until that channel exists, the absence of a private reporting destination is a release blocker; do not invent or guess a maintainer email address.

Include only the minimum reproducible information:

• affected plugin and Codex host versions;
• operating system and architecture;
• violated safety invariant;
• synthetic reproduction steps;
• whether source, Git, capability, Private Skill or diagnostic data was exposed;
• a redacted flight_diagnostics_report digest when useful.

Never send bearer tokens, real secrets, the project database, user source, complete command output or hidden model reasoning.

• Hooks are Codex host guardrails, not an operating-system sandbox.
• The plugin has no Computer Use.
• Agent topology is one level under Lead.
• Private Skills require explicit user-selected Forge commands.
• Automatic Git is local-only; the plugin cannot push, create a PR, tag, release or publish.
• Diagnostics are local, bounded and not automatically uploaded.
• A model completion claim cannot replace HOST_EXECUTED Evidence.

The full threat model is in docs/security/security-model.md.