codePilot v0.1 is a public preview and should only be used with trusted repositories. The supported security branch is the latest commit on main; no older release line currently receives fixes.
Please do not open a public issue for a vulnerability. Use GitHub's private vulnerability reporting feature for this repository. Include the affected commit, impact, reproduction steps, and any suggested mitigation. If private reporting is unavailable, open a minimal issue asking the maintainer to enable a private reporting channel without disclosing exploit details.
Reports about malicious behavior by Codex, Claude Code, repository dependencies, or user-configured validation commands are generally outside this project's boundary unless codePilot incorrectly exposes data or bypasses a documented guardrail.