Security fixes are made on the latest published version.

Do not open a public issue for a vulnerability that could expose OAuth tokens, local files, or command execution. Use the repository's private vulnerability reporting form. Include the affected version, reproduction steps, impact, and any suggested mitigation.

• The proxy binds only to 127.0.0.1 and uses a cryptographically random token for every launch.
• Proxy health, control, audit, and inference routes all require that token.
• gptCode never uses, exposes, or writes a Codex refresh token and never uses OPENAI_API_KEY.
• OAuth refresh is delegated to the installed Codex CLI through its app-server account API.
• Claude state is redirected to ~/.gptcode/claude with CLAUDE_CONFIG_DIR; normal ~/.claude state is not used.
• The bundled Claude plugin is loaded only for the gptCode process with --plugin-dir.
• Request dumps are off by default. Treat GPTCODE_DUMP output as sensitive because prompts and tool results may be present.

The Codex credential document is parsed to extract its short-lived access token, which is necessarily held by the local proxy process. The token is stripped from the Claude child environment. Do not run untrusted code under the same OS account while exposing debug dumps or process environments.