Codex-Turnloom is intended for trusted local networks only. Do not expose it to the public internet.

The first public release is 0.1.x.

If you find a security issue, please do not post sensitive details publicly. Open a minimal report with reproduction context and avoid including private Codex conversation data, account information, access codes, screenshots of QR codes, or local auth files.

When running, this service can expose local Codex conversation titles, messages, tool output, project paths, account display information, and local usage summaries to browsers that can reach the service and pass access-code authentication.

Recommended defaults:

• Keep access-code authentication enabled.
• Use --readonly when web input is not needed.
• Do not share terminal screenshots, QR codes, or fixed access codes with untrusted people.
• Do not bind or proxy this service to the public internet.

This project depends on Codex Desktop local files and private IPC behavior. These are not public compatibility contracts. Future Codex Desktop versions may break or change behavior in ways that affect security, sync, or browser-to-Codex controls.