# Security

This plugin is experimental and is not an OS sandbox. Auto permits approved tools under Full access; direct Node effects in run_code are not reviewed. Use an actual sandbox for untrusted execution.

Report suspected authorization bypasses, reviewer-tool execution, credential exposure, or lifecycle failures through GitHub private vulnerability reporting if available. Do not post credentials, private transcripts, account identifiers, or exploit payloads containing real data in public issues. If private reporting is unavailable, open a minimal issue requesting a private reporting channel without exploit details.

Maintained baseline: 0.1.x with DSH 0.2.0-rc.2, Node 22.19+/24+, macOS/Linux. Codex CLI 0.159.0 was live-verified; backend compatibility is experimental. No security guarantees are made for other combinations. Review model classification is probabilistic.