This repository distributes unofficial patch builds for upstream OpenAI Codex. It is not affiliated with or endorsed by OpenAI.

Security reports should focus on:

• vulnerabilities introduced by patches in this repository
• release automation risks in this repository
• integrity issues with distributed binaries or checksums

Upstream Codex vulnerabilities should also be reported to upstream when appropriate.

For security-sensitive matters, contact the maintainer privately:

• GitHub: @cowwoc
• Email: cowwoc2020@gmail.com

Please include:

• affected upstream Codex version
• affected patched release version
• platform and architecture
• reproduction details
• impact assessment
• whether a public upstream issue already exists

• The maintainer does not guarantee response times for unpaid reports.
• Security work with credible buyer interest or professional-services engagements receives priority.
• The maintainer may require review and scope approval before publishing any Paddle checkout link or invoice for a security-related fix.
• If the issue belongs upstream, the maintainer may decline to fix it here or may carry a temporary patch until upstream resolves it.

• Patch files should stay small, auditable, and removable.
• Each patch directory should map to one repository-relative reviewed issue.
• Releases should publish checksums and identify the exact upstream commit and patch list used.

This file provides process guidance only. It is not legal advice, and the maintainer should review any security-response commitments with a lawyer before relying on them.