简体中文 | English

Please do not disclose a security issue in a public GitHub issue before maintainers have had a reasonable opportunity to assess it. Use GitHub's private vulnerability reporting feature for this repository when available. If private reporting is unavailable, open a minimal issue asking the maintainer for a private contact channel without including exploit details.

Include:

• affected files and version or commit;
• expected and observed permission boundary;
• a minimal reproduction;
• possible impact;
• suggested mitigation, if known.

Relevant reports include:

• an installer overwriting files without explicit --force;
• path handling that writes outside the selected destination;
• a profile accidentally granting broader sandbox access than documented;
• instructions that authorize destructive or external actions implicitly;
• validation that silently accepts malformed or mismatched profiles;
• documentation that materially misstates Codex permission behavior.

Agent instructions are behavioral constraints. They cannot guarantee enforcement against every model or runtime failure. Actual filesystem and external-action boundaries depend on Codex sandbox and approval settings. The parent turn's live permission choices may override custom-agent defaults, as documented in the official subagents guide.

Users should inspect dry runs, avoid secrets in prompts, review diffs, and use runtime sandboxing appropriate to the work.