Security fixes are applied to the main branch. Use the latest commit from main unless a release tag says otherwise.

Do not open a public issue for a vulnerability.

Report security concerns privately through GitHub security advisories when available, or contact the repository owner directly through GitHub.

Include:

• Affected file or command.
• Impact and realistic abuse scenario.
• Reproduction steps.
• Suggested fix, if known.

This repository contains Codex skills, workflow protocols, templates, and local helper scripts. Security review should focus on:

• Shell or process execution.
• File writes outside the requested project.
• Unsafe path handling.
• Secret leakage in documentation or examples.
• Instructions that could weaken review, scope, or approval gates.