This repository is a community fork of openai/codex. Where to report a vulnerability depends on where the issue lives.

For issues in the fork's own code — Termux/Android compatibility patches, fork-owned CI and release workflows, or npm packaging — please report privately:

• Open a private GitHub Security Advisory on this repository, or
• Email security@mmmbuto.com (or dev@mmmbuto.com)

Please do not open a public issue for security reports, and allow reasonable time to address the issue before public disclosure.

For issues in unmodified upstream OpenAI Codex code, use OpenAI's program via their Bugcrowd engagement.

For Codex security boundaries — sandboxing, approvals, and network controls — see Agent approvals & security.