opencodex accepts security fixes on a best-effort basis for these lines:

If you report an issue against an older release, maintainers may ask you to reproduce it on main or the latest published package before triage continues.

Please avoid posting undisclosed vulnerabilities as public GitHub issues.

• Prefer this repository's GitHub private vulnerability reporting or GitHub Security Advisory flow when that option is available in the repository UI.
• If no private reporting option is available, do not include exploit details, secrets, or live targets in a public issue. Open a minimal issue that asks maintainers for a safe coordination path.
• Include affected versions, reproduction steps, impact, and any required configuration details.

The project does not publish a dedicated private security email in this repository.

Maintainers will review reports on a best-effort basis. Triage usually starts with:

• confirming the affected version or commit,
• reproducing the issue locally,
• evaluating impact and safe remediation scope,
• coordinating disclosure timing if a fix is needed.

• Remove secrets, tokens, cookies, and personal data from screenshots and logs before sharing them.
• For non-sensitive hardening ideas, public issues and pull requests are welcome after disclosure is no longer sensitive.