The Codex credential file at %USERPROFILE%\.codex\auth.json belongs on the local computer only. Do not commit it, upload it, put it in an issue or pull request, or share a screenshot that reveals its contents or live access token.

The repository ignores auth.json, environment files, private keys, and live generated PNG snapshots under outputs/. The public outputs/icon.png is an application asset, not account data. These safeguards help prevent accidents, but they do not replace a manual review of the GitHub Desktop Changes tab before every commit.

The embedded PowerShell bridge reads the local credential to request live reset information. The desktop app selects a free loopback port on 127.0.0.1; the browser compatibility dashboard uses 127.0.0.1:8765. The access token is not written into the HTML, URL, generated PNG, or browser-visible status data.

Generated PNGs still contain private reset and usage information. Keep them on the local computer. The README preview under docs/assets/ is synthetic and is safe for public documentation.

Please contact @benedictusrey privately through the contact method listed on that GitHub profile. Do not open a public issue with a credential, token, account identifier, or exploit details that expose a user's data.

Revoke or rotate the credential immediately. Remove the secret from the working tree and repository history before publishing further changes. Deleting it in a later commit is not enough because earlier Git history may still contain it.