Version 0.1.x is the currently supported line.

Report vulnerabilities privately to the repository owner through GitHub's private vulnerability reporting or a private direct channel. Do not include credentials, proprietary code, or production data in a public issue.

• Treat all task metadata and outbox payloads as local sensitive data.
• Protect the returned fencing token like a local capability and rotate it by registering a new task incarnation only through documented recovery override.
• Expect query responses to redact fencing tokens. Treat any token found in status, lease, negotiation, event, outbox, or side-effect output as a vulnerability.
• Never store credentials, access tokens, cookies, private keys, or proprietary source in coordinator fields.
• Hold the exact remote lease, use a stable idempotency key for every remote side effect, and confirm downstream state before marking it committed.
• Claim outbox items with the dispatcher's own active fencing token before sending. Bind receipts to the payload digest, require matching sent/readback message IDs, and recover stale in-flight items explicitly rather than resending silently.
• Treat delivery receipts as dispatcher-supplied host attestations. The coordinator validates their structure and bindings but cannot independently authenticate the host provider.
• Require receipt observation at or after claim time and never reuse one host message identity for multiple outbox items.
• Inspect orphaned worktrees and remote resources before using a manual override.
• Treat overrides as audited local operator assertions, not authenticated human approvals. Same-OS-user processes remain inside the trust boundary.
• Recover prepared Git proofs before restaging. A commit already at HEAD must be adopted unless the ref is explicitly moved back before abandonment.
• Do not directly release a path lease with dirty scope or any reachable commit that touched the scope during the lease, including a later reverted commit. Use the verified handoff flow; direct release is reserved for clean, untouched scopes.
• Do not claim or acknowledge an outbox item without an exact destination thread. Register the thread and reset the item first.
• Run the release scan against staged content, refs, reachable blobs, and commit/tag metadata. Supply private denylist terms through CTC_RELEASE_DENYLIST_JSON; never hard-code them in repository source. Symlinks are prohibited so scanning never follows paths outside the repository.
• Never open a database written by a newer schema version with an older coordinator binary; forward versions fail closed.
• Do not share the SQLite database across untrusted OS users or machines.
• Keep ~/.codex/team-coordinator mode 0700 and database/WAL files mode 0600 on POSIX systems.
• Review plugin source and MCP commands before installation.