Codex for Home Assistant can read and modify a Home Assistant configuration folder. Please treat security and privacy issues with care.

Security fixes are intended for the latest published release and the current main branch.

Development and canary testing may happen on the dev branch. Older releases are not actively supported unless a maintainer says otherwise in a specific issue or release note.

Please do not open a public issue with exploit details, working proof-of-concept code, private logs, tokens, device codes, or personal Home Assistant configuration.

If GitHub private vulnerability reporting is available for this repository, use the Report a vulnerability button on the Security tab.

If private vulnerability reporting is not available, open a minimal public issue that says you have a security concern and asks the maintainer to arrange private disclosure. Do not include sensitive details in that issue.

When reporting a vulnerability privately, include as much of the following as you can safely share:

• A clear description of the issue.
• The affected version or commit.
• Whether the issue affects the worker app, the custom integration, or both.
• Steps to reproduce in a safe test environment.
• The expected impact.
• Any relevant logs with secrets and private configuration removed.
• Suggested mitigations, if you know them.

Please use extra care when changing or reviewing:

• Codex CLI authentication and logout behavior.
• Worker API token generation, storage, rotation, or validation.
• Home Assistant Ingress validation.
• Home Assistant Supervisor or Core API calls.
• File reads and writes under /config.
• Task execution, cancellation, user replies, and task logs.
• AppArmor, container permissions, networking, mounted paths, and app/add-on configuration.

Test security reports and fixes only in an environment you own or have permission to use. Do not attempt to access, modify, or disclose another person's Home Assistant instance, configuration, credentials, logs, or devices.

Please give the maintainer reasonable time to investigate and fix confirmed vulnerabilities before publishing details publicly. Coordinated disclosure helps protect users while a fix is prepared.