Skip to content

Security: xxvk/codex-command-center-adapters

Security

SECURITY.md

Security Policy

Supported Versions

Version Supported
0.1.x

Security Model & Boundary

codex-command-center-adapters serves as a hardware control surface bridge connecting Elgato Stream Deck with the local Codex agent environment on macOS.

1. Human-In-The-Loop Verification

  • Approval Actions (C2 / C3): By default, dangerous command execution approvals require explicit physical gesture confirmation:
    • Short Press: Triggers a native macOS confirmation alert modal (NSAlert) requiring user interaction.
    • Long Press (≥600ms): Explicit, deliberate physical hold to approve directly.
  • Draft Safety Buffer: The Go On and No Wait actions pre-fill draft prompt text into the active conversation input area without automatically sending Enter/Return, preserving the human operator's final review.

2. Secret & Credential Isolation

  • The adapter does not store, log, or transmit any API keys, tokens, or plaintext credentials.
  • Debug logging (/tmp/codex-command-center-debug.log) only captures sanitized control identifiers, layout coordinates, and task state summaries.

Reporting a Vulnerability

If you discover a security vulnerability or privilege escalation risk within this project, please do not open a public issue.

Please report security issues via:

  • GitHub Security Advisories tab on the repository, or
  • Private email to the project maintainers.

We acknowledge receipt of vulnerability reports within 48 hours and aim to provide patched releases promptly.

There aren't any published security advisories