Please do not open a public issue for a security vulnerability.

Report it through GitHub Private Vulnerability Reporting. Please include clear reproduction steps, the affected version or commit, expected and actual behavior, and any practical impact.

This is a small, single-maintainer open-source project. We will make a reasonable effort to acknowledge reports and work with reporters to understand valid issues.

Security-sensitive areas include:

• Accessibility usage and global hotkey handling
• Pasteboard handling, text insertion, and Secure Input behavior
• Codex CLI process invocation and app-server IPC parsing
• Local settings, history, dictionary, and custom-instruction files under the HeyCodex Application Support folder
• Selected-text capture for Ask AI

• Vulnerabilities in the external Codex CLI itself; report those to OpenAI.
• Vulnerabilities in macOS or Apple system frameworks.
• Reports that require prior administrator or root access to the same Mac.

The latest version available on the default branch is supported. Older revisions may receive a fix at the maintainer’s discretion.