SECURITY.md

# Security

## Reporting a vulnerability

Do not open a public issue for a suspected vulnerability. Email
<info@filamentlabs.io> with the affected CUAR version, operating system,
reproduction steps, and potential impact. Do not include credentials, tokens,
raw App Server responses, or account-specific usage data.

## Trust boundaries

CUAR runs as local code with the same operating-system account and execution
constraints as Codex. It is not a privilege boundary.

The normal runtime resolves `codex` through the inherited `PATH`, starts
`codex app-server --stdio` without a shell, initializes the stable protocol,
and sends only `account/rateLimits/read`. It does not send thread, turn, login,
logout, write, nudge, or reset-consumption methods.

CUAR writes only its bounded local reset ledger. It creates the ledger
directory with user-only permissions when possible, writes the file with mode
`0600`, uses a same-directory temporary file and atomic rename, and serializes
cooperating CUAR processes with a short-lived directory lock. Symlinked ledger,
lock, and final cache-directory paths are rejected. The ledger is derived
cache data, not an authentication or account-identity boundary. CUAR uses only
one fixed-name temporary file, removes interrupted temporary writes before the
next transaction, and invalidates its comparison chain after an untrustworthy
report.

`CUAR_CODEX_BIN` is an explicit support-and-test override. Setting it delegates
the same trust to that absolute executable path, so users should not point it
to untrusted code.

`CUAR_TEST_MODE=1` enables the fixture-only `CUAR_TEST_FETCHED_AT` clock
override. These variables can deliberately make a report non-current and must
not be enabled for ordinary use. `CUAR_LEDGER_PATH` is an absolute-path
support-and-test override; in test mode, ledger writes are disabled unless that
override is explicitly supplied. CUAR's bundled skill never sets these
variables.

App Server stdout is treated as untrusted structured input. JSONL lines,
stderr, timeouts, response envelopes, and child cleanup are bounded. Raw
responses and operating-system errors are not copied into public CUAR output.

## Operational limitations

- A malicious process already running as the same user can alter executables,
  environment variables, or local Codex state.
- CUAR projections assume the current average burn continues; they are
  planning estimates, not guarantees.
- Reset observation cannot distinguish every unscheduled OpenAI reset from an
  account switch or coincident banked-reset change.
- OpenAI may change supported App Server behavior independently of CUAR.
- The initial release targets local Codex surfaces with Node.js and shell
  execution available; it does not claim ChatGPT web-only support.