The codex-workflows runner stores input snapshots, rendered prompts, raw Codex events, stderr, attempts, and final outputs under PLUGIN_DATA (or the documented per-user fallback) with private permissions. Repository files, workflow inputs, and upstream model outputs are untrusted data rather than instructions. Do not include API keys, credentials, or unnecessary personal data. Private file modes are not a multi-tenant security boundary; use a dedicated operating-system identity when local users do not trust one another.

workspace-write and danger-full-access workflows require explicit run flags. Writer serialization prevents concurrent writer processes for one project but is not transactional isolation, rollback, or a substitute for separate worktrees and operating-system sandboxing.

MCP project roots require separate local authorization and are revalidated on every call. Workflow definitions are versioned in a private project-scoped SQLite registry and mutate atomically through idempotent MCP requests with optimistic version checks. Agent authoring uses an owner-only byte-exact preview followed by an explicit reviewed: true apply with matching SHA-256 and preimage checks. Durable MCP task records are owner-only beneath $CODEX_HOME/workflow-governor-mcp/; they may contain the original tool arguments and authoritative result, so the same credential and personal-data warning applies. Native Tasks do not widen workflow sandboxes, write flags, call budgets, root authority, or cancellation ownership.

Please report security issues through GitHub private vulnerability reporting, not a public issue. Include the affected version, reproduction steps, and impact.