Use GitHub's Report a vulnerability form. Maintainers must enable and verify this route as part of the publication procedure. Do not open a public issue or PR containing an unpatched vulnerability, credential, private Linear description, or session transcript.
Include the affected source commit, relevant skill or script, host version, expected and observed behavior, and a minimal reproduction using synthetic data. Describe the impact without attaching live credentials or other users' data. Korean and English reports are welcome. This personal project has no guaranteed response time.
Security fixes target the current dev branch. There are no separately maintained
release lines. The main branch mirrors the released source; its name alone does not
establish a supported release.
This repository distributes instructions and an installer, not a sandbox or an authorization service. Skills can request actions from the host; the host's actual permissions and the user's task scope remain the boundary. Review source changes before updating a linked installation: edits become visible through symlinks.
Nothing automatic changes the user's Codex configuration. Only commands the user runs
explicitly do: crw doctor retrust, which records hook trust in config.toml, and
crw install with its subcommands, which includes the subagent role files it writes
under ~/.codex/agents/<role>.toml. Each writes a backup before it replaces an existing
file, and crw doctor retrust restores that backup when the write or its verification
fails.
Report defects in a separately installed bridge or relay to that component's maintainer unless the problem is in this repository's instructions or installer. CXC v0.2.40 is being self-ported into this repository's Go runtime: report a defect in the ported code here. A defect in the installed upstream CXC plugin goes to its maintainer, and one the port reproduces on purpose is listed in known defects, one file per issue in docs/port-cxc/known-defects/. Offline fixtures do not prove that a live host integration is safe or compatible.