Please report security vulnerabilities privately through GitHub's Report a vulnerability button on the repository's Security page. This keeps the report, reproduction details, and any suggested fix private while we investigate.

Please do not open a public issue for an undisclosed vulnerability and do not include credentials, cookies, access tokens, or other secrets in a report.

We will acknowledge a valid report, investigate the affected code or dependency, and publish a fix or mitigation through the normal release notes.

codex-barbar is a local Windows tray application. Reports about the local Codex installation, Windows configuration, or third-party services should include the affected component and a minimal reproduction when possible.