Security fixes are applied to the latest tagged release and main.

Do not open a public issue containing transcripts, local paths, credentials, thread IDs, database fragments, or recall archives. Use GitHub's private vulnerability reporting for this repository. Include a minimal synthetic reproduction whenever possible.

Codex Upkeep is local-first. Its Python scripts do not make network requests. Archive output can still contain private project context, filenames, user prompts, assistant outcomes, and local paths. Common credential patterns are redacted as defense in depth, not as a guarantee of anonymization.

Do not publish a generated archive without a separate manual privacy review.

The project does not implement its own Codex SQLite deletion engine. Optional pruning delegates to an installed codex-sessions-manager executable after local manifest and verification checks. Review that dependency and its security model independently before enabling prune mode.

Codex Upkeep never requests permanent deletion, never passes an active-session override, and never purges backend or operating-system Trash.

The project is designed to mitigate:

• prompt injection embedded in old transcripts;
• deletion of the current or pinned task;
• stale archive or time-of-check/time-of-use drift;
• accidental selection expansion through parent/child recursion;
• secret exposure in normal audit output;
• unsupported SQLite mutation;
• false disk-savings attribution.

It cannot protect against a malicious same-user process changing files between operating-system checks, a compromised Python runtime, a malicious deletion backend, or secrets that do not match known redaction patterns.