Report suspected vulnerabilities in this connector to Radware through your normal Radware support channel, or to your Radware account team. Please include:

• the connector version (python install.py --status),
• the Codex version and surface (CLI, desktop app, IDE extension),
• the operating system,
• what you observed and what you expected,
• a reproduction if you have one.

Do not include Radware API keys, prompts containing customer data, or Security Event contents in the initial report.

In scope: the hook shim, the installer, and the configuration this connector writes.

Out of scope: OpenAI Codex itself, the Radware Agentic AI Protection service, and guardrail detection decisions (a false positive or false negative is a support case for the Radware service, not a vulnerability in this connector).

• The key is stored in ~/.radware/codex-hook.json with permissions 0600.
• A file is used rather than only environment variables because the Codex desktop app is launched from the Start menu or Dock and does not inherit a shell environment.
• RADWARE_OUT_OF_PATH_API_KEY overrides the file where it is set, which suits CI and short-lived environments.
• The key is sent only to the Radware endpoint, in the request body, over HTTPS.
• Diagnostics are redacted: key-shaped values (sk-rdwr-, sk-proj-, generic sk-, nvapi-, AIza, bearer headers) are replaced before anything is written to stderr, and request bodies are never logged verbatim because they carry the key.
• python install.py --uninstall --purge deletes the stored key.

• Fail-closed by default. If Radware cannot be reached, times out, returns a non-2xx, or returns a response without a usable verdict, the action is blocked. Fail-open is an explicit opt-in (--fail-open) and is logged loudly every time it allows something through uninspected.
• A crash is treated as a block. Codex treats exit code 2 as "deny" and any other non-zero exit as a non-blocking warning, so an unhandled error would otherwise fail open. Every error path returns 2 under the default fail mode.
• Unapproved hooks do not run. Codex requires hooks to be trusted, and skips untrusted hooks silently. After installing, approve them once; after changing hook configuration, approve again. python install.py --status shows what is registered.
• Monitoring-only events are never sent. PostToolUse and similar events cannot block, so they are not submitted for a verdict.

For each prompt, the prompt text. For each tool call, the tool name, its arguments, and the prompt that led to it, plus recent conversation context so intent can be judged. This is the mechanism of the protection, and it means prompts and proposed commands leave the machine for inspection. Confirm this against your organisation's data-handling policy before deploying widely.

The latest release is supported. Codex 0.145 or newer is required, because lifecycle hooks do not exist in earlier versions.