Security fixes are applied to the latest published release of CodexTray.

Please do not open a public issue for a suspected vulnerability. Use GitHub's Report a vulnerability flow on the repository Security tab to submit a private advisory.

Include, when possible:

• the affected version;
• a concise description of the issue;
• reproduction steps or a proof of concept;
• the potential impact;
• any suggested remediation.

You should receive an initial response within seven days. Confirmed vulnerabilities will be investigated, fixed, and disclosed responsibly.

CodexTray is a local desktop application. It:

• reuses the authentication state maintained by Codex/CodexBar;
• does not include project-owned telemetry or remote services;
• does not persist account email or usage responses;
• masks the dashboard email by default;
• invokes subprocesses with argument arrays rather than a shell;
• requires user confirmation before consuming a reset credit;
• verifies the SHA-256 checksum of the pinned CodexBar release during packaging.

CodexTray depends on the locally installed Codex CLI and packages a pinned CodexBar CLI release. Users should install releases only from this repository and verify published checksums when transferring packages through an untrusted channel.