Skip to content

security.md

Latest commit

聽

History

History
27 lines (24 loc) 路 1.32 KB

security.md

File metadata and controls

27 lines (24 loc) 路 1.32 KB
Raw

Security model

Sango is intentionally not sandboxed because it must launch the installed Codex CLI, inspect related processes, and atomically replace the effective CODEX_HOME/auth.json.

  • The active account remains plaintext in auth.json, with mode 0600, as required by Codex's file credential mode.
  • Inactive opaque credential documents are stored in macOS Keychain under profile UUIDs. Secret payload types are neither logged nor exposed through FFI.
  • Temporary Codex homes used for enrollment and inactive polling are owner-only directories and are removed on success, cancellation, timeout, or failure.
  • SQLite stores only profile metadata, settings, usage, and secret-free switch journal data.
  • Switching is blocked while another Codex CLI, app-server, IDE helper, or Codex desktop process is running. Sango offers graceful termination before a separate, explicit force-quit action.
  • Sango changes only cli_auth_credentials_store after explicit consent. It records the prior value and restores it only if the user has not since edited that setting.
  • Sango has no telemetry and reaches OpenAI only through the installed codex app-server process.

The app-server protocol is experimental. A compatibility probe is performed at startup, and incompatible builds are rejected before credentials are modified.