Saved Codex sessions are encrypted with Windows DPAPI CurrentUser. This protects copied vault files from offline use by another Windows account, but it does not protect against malware or processes already running as the same user. The active Codex auth.json remains plaintext because Codex must read it.

The project has no network server, telemetry, updater, portable credential export, quota API, or online installer.

Please use the repository Security tab to submit a private vulnerability report. Do not include real tokens, auth.json, vault files, verification codes, passwords, or personal account data.

Only the latest commit on the default branch is supported.