Only the latest code on the master branch is actively maintained. There are currently no published release versions.

Please report suspected vulnerabilities privately through GitHub Security Advisories. Do not open a public issue or include exploitable details in a pull request.

Please include:

• a concise description of the impact;
• steps or a minimal proof of concept to reproduce it;
• affected commit, platform, and Bun/Codex versions;
• any suggested mitigation, if known.

You should receive an acknowledgement within seven days. We will coordinate a fix, disclosure timeline, and credit with the reporter where appropriate.

When reporting, redact prompts, credentials, tokens, email addresses, account identifiers, and private filesystem paths.