Skip to content

Security: WakeHao/codex-native-notify

Security

SECURITY.md

Security / 安全说明

English

Codex Native Notify installs a user-level executable hook under ~/.codex. Review the installation prompt and every proposed configuration change before approving it. Never use a copy from an untrusted source.

The hooks only send notifications. PermissionRequest must not approve, deny, rewrite, or interrupt a request. Stop must return {} and must not continue a completed turn.

Notifications contain the current working directory's basename. When iPhone delivery is enabled, that name is stored in iCloud Reminders and may appear on the lock screen. Avoid using this project in directories whose names contain sensitive client, repository, or personal information.

To report a vulnerability, open a GitHub security advisory after the repository is published. Do not include secrets or private Codex configuration in a public issue.

中文

Codex Native Notify 会在 ~/.codex 下安装一个用户级可执行 Hook。批准安装 前,请先审阅安装提示词以及 Codex 准备进行的每一项配置修改,不要使用来自 不可信来源的副本。

两个 Hook 只负责通知。PermissionRequest 不得批准、拒绝、改写或中断请求; Stop 必须返回 {},不得让已经完成的任务自动继续。

通知会包含当前工作目录的名称。开启 iPhone 通知后,该名称会写入 iCloud 提醒事项,并可能显示在锁屏上。请避免在目录名含客户、仓库或个人敏感信息时 使用本项目。

仓库发布后,请通过 GitHub Security Advisory 报告漏洞。不要在公开 Issue 中 粘贴密钥或私人 Codex 配置。

There aren't any published security advisories