# Security

## Credentials

This package never commits or intentionally prints OAuth access or refresh tokens. By default it stores its dedicated credential at:

- `${DSH_HOME}/llm-chatgpt-oauth/oauth.json`, or
- `~/.dsh/llm-chatgpt-oauth/oauth.json` when `DSH_HOME` is unset.

Credential updates use a same-directory temporary file, mode `0600`, file sync, and atomic rename; the package-owned default directory is repaired to mode `0700`. Treat the resulting file like a password. Never attach it, `~/.codex/auth.json`, or terminal output containing authorization codes to an issue.

The optional Codex CLI bootstrap copies an existing ChatGPT OAuth credential into the connector store. A dedicated device-code login (`dsh-llm-chatgpt-auth login`) is recommended for shared deployments because it gives the connector an independently managed OAuth grant.

Custom request headers in the `llm-chatgpt-oauth` settings section are redacted from settings wire responses, but the file-backed settings provider stores them in plaintext in `settings.yaml`. Authorization, cookie, proxy-authorization, and HTTP transport headers are rejected. Never place OAuth access or refresh tokens in settings.

## Trust boundaries and limitations

- The connector decodes the access token's JWT payload only to copy expiry/account metadata from a locally trusted Codex CLI credential. It does not treat that decode as signature verification; OpenAI performs authoritative bearer-token and grant validation on requests and refreshes.
- Credential operations and settings-driven backing-store swaps are serialized inside one process. Multiple DSH processes sharing one credential file are not supported because no cross-process lock is taken.
- Explicit `credentialFile` and `codexAuthFile` paths are administrator-controlled. Keep their parent directories private and do not point them through untrusted writable directories.
- The authentication CLI contains failures to a one-line message instead of rendering upstream error stacks and causes.

## Reporting a vulnerability

Please report vulnerabilities privately through the repository's [GitHub Security Advisory page](https://github.com/zhangxiubo/dsh-llm-chatgpt-oauth/security/advisories/new). Include reproduction steps without credentials, authorization codes, account identifiers, or private filesystem paths.

## Supported versions

Only the latest release line is supported. Version `0.1.0` targets exactly DeepSeek Harness `0.1.0-rc.7`, `@deepseek-ai/dsh-llm-pi-ai` `0.1.0-rc.7`, and pi-ai `0.82.1`; those pins protect a private-by-convention adapter construction seam.