稳定版更新资产必须通过 references/update-trust.json 内公钥的 Ed25519 detached signature 验证。对应的 32 字节私有 seed 必须用 scripts/init_release_signing_key.py 在仓库外生成并独立备份，只能以 SUPERDISCUSSION_RELEASE_SIGNING_SEED 写入 GitHub Actions Secret；不得提交、记录、粘贴到对话或打入发布包。公钥或 CI Secret 未配置、两者不匹配时，发布流程必须关闭失败。
Stable update assets are accepted only when their detached Ed25519 signature verifies against references/update-trust.json. Generate the corresponding 32-byte seed outside the repository with scripts/init_release_signing_key.py, back it up separately, and store it in GitHub Actions only as SUPERDISCUSSION_RELEASE_SIGNING_SEED. Never commit, log, paste into chat, or package the seed. A missing or mismatched trusted key/CI secret must fail closed.
当前支持的安全更新范围为最新的 0.1.x 版本。预发布版本可能发生不兼容变更。
安装 Skill 或保存 API Key 不会触发外部调用。每条外部授权链由当前 Codex 对话身份的哈希、无损项目目录身份、任务 ID、调用用途及目的地指纹共同绑定；目的地指纹覆盖端点、模型、网络范围与直接/显式代理路径。任一目的地配置变化，或新对话、新项目、新任务，都不能继承旧授权；v1 授权升级后也必须重新确认，连通性检查不能授权实质协作。用户可在对话中撤销单个 Provider、当前任务或整个对话，也可在本机全局暂停外部调用。任务级恢复不会解除对话级封锁。撤销无法追回已经送达 Provider 的内容，但每次 HTTP 重试、故障切换、流式帧和后续探测都会重新检查授权；撤销后才完成的在途响应会被丢弃，旧授权链和旧父记录不能启动新请求。
运行时不继承系统代理环境变量，只接受配置中的显式代理。Provider 的全部 DNS 解析结果与实际连接地址都会按 public/loopback/private 策略复核，并永久拒绝 metadata、link-local、CGNAT、保留、组播、未指定及 mapped-address 绕过。连接建立、流式无进展和非流式读取分别配置；非流式深度审核默认没有运行时总读取期限。
外部 Provider 只能看到运行时实际发送的结构化上下文，不能直接读取 Codex 聊天、终端或文件系统。调用一旦获得授权并发送，Provider 对该请求的处理与保留仍受其自身服务政策约束。
上下文扫描会拒绝多角色 transcript 和连续三行以上的单角色 transcript。对于 .py、.ts 等源码工件，JSON 中的 role 字段可能是正常消息处理代码，无法仅靠文本启发式可靠区分源码与嵌入式 transcript；因此源码工件允许这类字面量。这是已知的启发式边界，Codex 必须只发送当前项目中确有必要的、带路径与内容哈希的源码或片段，不能把聊天记录伪装成源码。
请通过 GitHub 仓库的 Security → Report a vulnerability 私密报告漏洞。报告应包含受影响版本、可复现步骤、影响范围和建议修复，但不得包含真实 API Key、用户上下文或其他第三方秘密。
在维护者发布修复或明确允许公开前，请不要创建公开 Issue、Pull Request 或披露利用细节。额度不足、Provider 服务中断或上游模型行为变化通常不是本项目安全漏洞，除非它们导致授权绕过、秘密泄露、状态破坏或未经允许的外部调用。
Security updates currently target the latest 0.1.x release. Pre-release versions may contain incompatible changes.
Installing the Skill or saving an API key does not trigger an external call. Each external authorization chain is bound to the hash of the current Codex conversation identity, the lossless project-directory identity, task ID, call purpose, and a destination fingerprint covering endpoint, model, network scope, and direct/explicit-proxy route. A destination change or a new conversation, project, or task cannot inherit the grant; migrated v1 grants also require renewed confirmation, and connectivity checks cannot authorize substantive collaboration. The user may revoke one provider, the current task, or the complete conversation, and may globally pause external calls on the installation. Task restoration does not lift a conversation-wide block. Revocation cannot recall content already delivered to a provider, but authorization is rechecked before every HTTP retry, failover, streaming frame, and follow-up probe. A response that finishes only after revocation is discarded, and old grants and parent records cannot start a new request.
The runtime does not inherit system proxy environment variables and accepts only an explicitly configured proxy. Every DNS result and the address actually connected to are checked against the public/loopback/private policy; metadata, link-local, CGNAT, reserved, multicast, unspecified, and mapped-address bypasses are always rejected. Connection establishment, streaming inactivity, and non-streaming reads have separate controls; deep non-streaming review has no runtime total-read deadline by default.
An external provider sees only the structured context actually sent by the runtime and cannot directly read the Codex chat, terminal, or filesystem. Once an authorized request is delivered, provider handling and retention remain subject to that provider's service policies.
Context scanning rejects multi-role transcripts and runs of at least three single-role transcript lines. In source artifacts such as .py and .ts, JSON role fields may be legitimate message-processing code and cannot be reliably distinguished from an embedded transcript by text heuristics alone, so those literals remain allowed. This is a documented heuristic boundary: Codex must send only necessary source files or excerpts from the current project, with paths and content hashes, and must never disguise chat history as source code.
Use Security → Report a vulnerability in the GitHub repository to submit a private report. Include the affected version, reproduction steps, impact, and a proposed mitigation when available. Never include real API keys, user context, or other third-party secrets.
Do not open a public Issue or Pull Request or disclose exploit details until maintainers publish a fix or explicitly permit disclosure. Insufficient quota, provider outages, and upstream model behavior changes are generally not project security vulnerabilities unless they cause an authorization bypass, secret disclosure, state corruption, or an unauthorized external call.