Security fixes are provided for the latest master branch and the latest tagged release.

Please do not open a public issue for a suspected vulnerability.

Use one of these paths instead:

• Open a private GitHub security advisory if you have repository access.
• Otherwise contact the maintainer privately through GitHub and include a minimal reproduction.

Helpful report details:

• affected command or script
• exact input that triggers the issue
• expected impact
• operating system and Python version
• whether credentials, tokens, local files, or generated artifacts are involved

This project is a local Codex skill and CLI toolkit. Security-sensitive areas include:

• handling of GitHub/GitLab tokens
• local cache files under the user's cache directory
• SBOM and vulnerability report generation
• adapter scaffolding output written into user projects
• temporary install/smoke-test directories

The maintainer will aim to acknowledge valid reports within 7 days and publish a fix or mitigation plan after the issue is understood.