Security fixes target the latest release on main.

The transport server, state, authority files, helper execution, and attachments are self-hosted on the user's Mac. Model processing is not necessarily local. The assembled prompt is submitted through the signed-in Codex App and is governed by that Codex account and provider's data controls.

Depending on configuration, a prompt can contain message text, all seven authority-file bodies, attachment paths, audio transcripts, Memory Forest route output, and enabled helper output such as Mail, Calendar, Reminders, document, or location context. Exact sender, conversation, message identifiers, and absolute authority-file paths are excluded by default. Setting INCLUDE_TRANSPORT_IDENTIFIERS_IN_PROMPT=true intentionally includes the exact transport identifiers.

Review the applicable Codex account, organization, retention, privacy, and regional controls before connecting private sources. Do not describe this project as an offline model or a fully local AI system.

• Keep BRIDGE_HOST on loopback.
• Keep .env as a real regular file with mode 0600; startup rejects symlinks and broader permissions.
• Protect operator endpoints with the generated bearer token.
• Keep Codex App, BlueBubbles, and bridge debug or API ports off untrusted networks.
• Put a TLS reverse proxy or authenticated tunnel in front of only the enabled webhook paths. Rewrite Host to the configured loopback host and port. Never expose /ask, /pending, /transport-inbox/*, /health/details, or /bluebubbles/*.
• Keep raw webhook bodies bounded with TRANSPORT_MAX_BODY_BYTES.
• Configure every enabled transport with one stable owner and one stable conversation. A second principal requires a separate instance, private state directory, authority set, port, and Codex task.
• Keep INCOMING_ATTACHMENT_MAX_BYTES bounded. Downloads stream through private temporary files and oversized partial files are removed.
• Manual downloads use bridge-managed paths under ATTACHMENT_DIR. Manual send and transcription routes accept only bounded real regular non-symlink files under that root. Generated output is accepted only from the exact generated-image or rich-link roots documented by the release.
• Direct BlueBubbles actions recheck the configured destination, and message-specific actions require a message or attachment previously observed on that allowed route. Direct FaceTime operator routes are disabled in the public personal release.
• Begin with BRIDGE_TRUST_PROFILE=review and BRIDGE_AUTO_SEND=false.
• Treat full as automatic bridge-output delivery permission, not as a perimeter bypass.

Each transport authenticates its provider before parsing or admitting user data.

• BlueBubbles uses a separate high-entropy webhook secret plus the BlueBubbles server password.
• Telegram requires X-Telegram-Bot-Api-Secret-Token and exact numeric chat and user allowlists.
• Slack verifies the exact raw request body with the Slack v0 HMAC, rejects timestamps outside the replay window, and requires exact workspace, channel, and user allowlists.
• WhatsApp verifies the GET subscription token separately from the POST X-Hub-Signature-256 HMAC and requires exact business-number and sender allowlists.
• Microsoft Teams uses Bot Framework bearer-token authentication with signature, issuer, audience, time, tenant, conversation, user, and service-origin checks. A secret webhook URL is not Teams authentication.

Authenticated Telegram, Slack, WhatsApp, and Teams event identities are hashed before entering the bounded private inbox. The normalized message text and reply-route metadata are stored until completion, so the inbox is sensitive local state. Provider tokens and raw webhook bodies are never stored there. Completion atomically replaces the payload with a bounded dedupe record.

An interrupted admitted cloud event replays automatically. An interrupted claimed event does not replay blindly and appears under the authenticated /transport-inbox/attention route. Confirm a retry only after inspecting the dedicated Codex task and pending queue. BlueBubbles uses a separate ten-minute process-memory retry cache, so a bridge restart is not a durable BlueBubbles dedupe boundary.

review writes generated replies to a private bounded pending file and blocks direct bridge mutation endpoints. A confirmed /pending/.../send remains the deliberate delivery action. The pending queue survives a normal restart, but a process stop immediately after provider acceptance can leave delivery ambiguous. Inspect the target conversation before confirming the same pending reply again. Review mode does not isolate the Codex process from the rest of the same macOS account.

Codex with shell, Computer Use, filesystem, Keychain, or Automation access may have other ways to reach local applications or credentials. Keep Codex approvals and macOS permissions enabled, grant the minimum access required, and use a separate macOS account or machine when a real principal boundary is needed. full does not widen an allowlist and does not turn helper context into authority.

Never publish .env, passwords, API keys, operator or webhook tokens, generated authority files, helper manifests, local logs, state, attachments, transcripts, message identifiers, handles, phone numbers, email addresses, account data, location observations, Calendar or Mail data, private memory, or screenshots containing real content.

Generated authority directories, helper executables, Memory Forest directories, transport inboxes, pending replies, other state, and logs should use private local permissions and remain outside the repository.

Only configure read-only helpers you own and have inspected. Command helpers run with the bridge user's operating-system permissions. The bridge strips its environment to a small allowlist, limits helper input fields, enforces time and output caps, and labels results as context data. A helper is still trusted local code and can access anything its macOS account can access. Its returned text enters the Codex prompt.

Do not use command helpers to cross macOS home-directory boundaries. A cross-user or remote helper requires a separately authenticated and threat-modeled relay that is not included in version 0.3.

Report a vulnerability through GitHub's private vulnerability reporting feature when available. Do not include live secrets, private messages, or personal data in a public issue.