opencodex accepts security fixes on a best-effort basis for these lines:

If you report an issue against an older release, maintainers may ask you to reproduce it on main or the latest published package before triage continues.

Please avoid posting undisclosed vulnerabilities as public GitHub issues.

Report privately through GitHub private vulnerability reporting, which is enabled on this repository:

https://github.com/lidge-jun/opencodex/security/advisories/new

The same form is reachable from the repository's Security tab under Report a vulnerability. It is private between you and the maintainers, and it is the only channel this project offers for undisclosed vulnerabilities — there is no dedicated private security email.

Include affected versions, reproduction steps, impact, and any required configuration details.

If the form is ever unreachable for you, open a minimal public issue that asks maintainers for a safe coordination path. Do not include exploit details, secrets, or live targets in that issue.

Maintainers will review reports on a best-effort basis. Triage usually starts with:

• confirming the affected version or commit,
• reproducing the issue locally,
• evaluating impact and safe remediation scope,
• coordinating disclosure timing if a fix is needed.

• Remove secrets, tokens, cookies, and personal data from screenshots and logs before sharing them.
• For non-sensitive hardening ideas, public issues and pull requests are welcome after disclosure is no longer sensitive.