Skip to content

Security: Substrate-memory/codex-substrate-memory

Security

SECURITY.md

Security policy

Supported versions

Supported versions are identified by published releases of codex-substrate-memory.

Report a vulnerability

Use GitHub's private Security advisories → Report a vulnerability flow for this repository. Do not open a public issue containing a credential, private history, server URL, spool contents, traceback with user content, or exploit details.

Reports must use content-free diagnostics where possible:

  • plugin and Codex CLI versions;
  • operating system and Python version;
  • affected lifecycle/tool operation;
  • failure category;
  • minimal synthetic reproduction; and
  • expected and observed security boundary.

Security boundary

The API key is read from the process environment ONLY and is never written to a config file. Host config files are world-readable plaintext. Reports go through GitHub private security advisories. Diagnostics are content-free.

The plugin rejects unsafe redirects and unexpected response shapes, redacts before queueing, persistence, or network transfer, and uses bounded request, response, spool, and retry resources.

Redaction cannot identify every sensitive statement. Operators remain responsible for choosing a trusted Substrate server and protecting local host state.

There aren't any published security advisories