Skip to content

Codex session files can contain secrets (API keys, tokens, passwords) #2

@rayanweragala

Description

@rayanweragala

Not sure if this has been considered, but Codex session JSONL files can easily end up with sensitive stuff in them — API keys, tokens, passwords set via env vars or shell commands during the session.

The thing is, Euphony supports loading from public URLs (like Hugging Face), so if someone shares a session file without realizing there are credentials in it, anyone with the link can just read them in the viewer.

Would be great to have at least a warning when rendering Codex sessions, or some basic pattern detection that flags potential secrets before displaying them. Even just a note in the README telling people to check their session files before sharing would help.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions