Security Policy

Supported Versions

opencodex accepts security fixes on a best-effort basis for these lines:

Version	Supported
main	✅
Latest published npm release	✅
Older releases	❌

If you report an issue against an older release, maintainers may ask you to reproduce it on main or the latest published package before triage continues.

Reporting a Vulnerability

Please avoid posting undisclosed vulnerabilities as public GitHub issues.

Report privately through GitHub private vulnerability reporting, which is enabled on this repository:

https://github.com/lidge-jun/opencodex/security/advisories/new

The same form is reachable from the repository's Security tab under Report a vulnerability. It is private between you and the maintainers, and it is the only channel this project offers for undisclosed vulnerabilities — there is no dedicated private security email.

Include affected versions, reproduction steps, impact, and any required configuration details.

If the form is ever unreachable for you, open a minimal public issue that asks maintainers for a safe coordination path. Do not include exploit details, secrets, or live targets in that issue.

Response Expectations

Maintainers will review reports on a best-effort basis. Triage usually starts with:

• confirming the affected version or commit,
• reproducing the issue locally,
• evaluating impact and safe remediation scope,
• coordinating disclosure timing if a fix is needed.

Operational Notes

• Remove secrets, tokens, cookies, and personal data from screenshots and logs before sharing them.
• For non-sensitive hardening ideas, public issues and pull requests are welcome after disclosure is no longer sensitive.