Please report suspected vulnerabilities privately through this repository's Security tab: choose Report a vulnerability to open a private GitHub Security Advisory draft. Do not include sensitive details in a public issue, discussion, or pull request.

Include, when available:

• The affected file, version, or commit.
• The impact and conditions required to reproduce it.
• Minimal reproduction steps or a proof of concept.
• Any mitigation you have already tested.

You should receive an acknowledgement within five business days. Maintainers will investigate, coordinate a fix and disclosure when appropriate, and credit reporters who want attribution. Please allow reasonable time for remediation before public disclosure.

Security fixes are applied to the latest release and the default branch. Older releases may not receive patches; users should upgrade before reporting an issue that is already fixed upstream.

This policy covers files maintained in this repository. OpenAI Codex, model access, account security, and third-party platform behavior should be reported to the relevant provider.