CodexPro exposes a local workspace to an MCP client. Treat it like a developer tool with access to your source tree, not like a hosted SaaS app.

Security fixes target the latest published version only until the project reaches 1.0.0.

Please report security issues privately before opening a public issue. If the repository has GitHub private vulnerability reporting enabled, use that. Otherwise contact the maintainer listed by the project owner.

Do not include secrets, private repository contents, tunnel tokens, or .env values in reports.

CodexPro is not designed to bypass, avoid, pool, resell, or modify ChatGPT, Codex, OpenAI, or third-party model limits. Do not market, deploy, or configure it that way.

Each user should connect their own ChatGPT account, use only product surfaces available to that account, and follow the limits, safety rules, and terms for ChatGPT, Codex, OpenAI, and any third-party model provider they connect.

CodexPro can expose:

• file metadata and selected file contents from allowed workspaces
• git status and diffs
• .ai-bridge planning files
• optional shell command execution through the bash tool, hidden when bash mode is off
• optional write/edit capability depending on CODEXPRO_WRITE_MODE, advertised only in workspace write mode
• optional local handoff execution through codexpro execute-handoff, run from the user's terminal only
• optional local execute/review looping through codexpro loop-handoff, run from the user's terminal only with a user-provided reviewer command and iteration limit

Review changes against these failure modes before release:

The main risks are:

• connecting an untrusted MCP client
• exposing the server through a public tunnel without auth
• running with CODEXPRO_BASH_MODE=full
• running with CODEXPRO_WRITE_MODE=workspace on an important repo
• executing an untrusted .ai-bridge/current-plan.md or custom execute-handoff --command
• running loop-handoff with an untrusted reviewer command or without a small --max-iters
• adding overly broad allowed roots
• leaking a codexpro_token or Cloudflare tunnel token
• trusting a downloaded cloudflared binary without understanding where it came from

Default daily mode:

codexpro start \
  --root /path/to/repo \
  --bash safe \
  --tunnel cloudflare

Safer planning-only mode:

codexpro start \
  --root /path/to/repo \
  --mode handoff \
  --bash safe \
  --tunnel cloudflare

For stable public hostnames, keep the CodexPro auth token stable but private:

codexpro start \
  --root /path/to/repo \
  --tunnel cloudflare-named \
  --hostname codexpro.example.com \
  --tunnel-name codexpro \
  --token <long-random-token> \
  --bash safe

• Do not run public tunnels with --no-auth.
• Public tunnel mode and non-loopback binds fail closed if CODEXPRO_HTTP_TOKEN is missing.
• Do not commit printed connector URLs that include codexpro_token.
• Do not commit Cloudflare tunnel tokens.
• Do not paste raw Cloudflare tunnel tokens into browser pages or screenshots. Use --cloudflare-token-file or the local page's Cloudflare token file field instead.
• Use --mode handoff for planning workflows where ChatGPT should not edit source files. Handoff mode does not advertise generic write/edit tools.
• Preview local handoff execution with codexpro execute-handoff --dry-run before running an unfamiliar adapter or custom command.
• Preview autonomous local loops with codexpro loop-handoff --dry-run, keep --max-iters small, and prefer --require-human-confirmation until you trust the reviewer command.
• Keep execute-handoff local. Do not wrap it in a remote MCP tool unless you add a stronger approval and sandbox story.
• Keep loop-handoff local. Do not use it to automate ChatGPT Web, Codex approvals, account access, third-party Pro sites, quota limits, or product safety prompts.
• Use default agent mode only with trusted ChatGPT sessions and repo-specific roots.
• Use --no-bash when ChatGPT should never trigger shell commands in the workspace.
• Use --bash-session <id> --require-bash-session when bash should be enabled only for calls that explicitly target this local CodexPro terminal label.
• Keep Codex session history access off unless needed. --codex-sessions metadata only lists local Codex JSONL metadata; --codex-sessions read allows bounded transcript reads.
• Keep CODEXPRO_CONTEXT_DIR as a workspace-relative hidden directory such as .ai-bridge; CodexPro rejects source, build, dependency, credential, and absolute context directories.
• Use --bash full only for trusted local repos.
• Do not treat MCP session ids or bash session labels as Codex conversation ids. CodexPro does not execute inside a Codex app session.
• Prefer a repo-specific --root instead of --allow-home.
• Use --no-install-cloudflared --cloudflared <path> if your organization requires a managed Cloudflare Tunnel binary.

For the one-command public tunnel flow, CodexPro can download the official Cloudflare cloudflared release into ~/.codexpro/bin on supported macOS, Windows, and Linux systems. It does not install a system service, does not use sudo/admin rights, and does not modify shell startup files.

Resolution order:

1. explicit --cloudflared path or CLOUDFLARED_BIN
2. cloudflared already available in PATH
3. ~/.codexpro/bin/cloudflared or cloudflared.exe
4. download official Cloudflare latest release unless --no-install-cloudflared is set

Use --install-cloudflared to refresh the local binary. Use --no-install-cloudflared to disable downloads.

CodexPro blocks common sensitive paths by default:

• .env and .env.*
• .git internals
• node_modules
• common private key names
• build/cache folders such as dist, build, .next, coverage, .cache
• symlinks that resolve outside the workspace or into blocked paths

These guards reduce risk. They are not an OS sandbox.