Open Codex Micro is intentionally local. The reference firmware has no network stack, telemetry, or credential storage. Treat custom host integrations as untrusted local programs: review them before running, keep dependencies updated, and do not map a physical key to a destructive command without a confirmation step.

Report a security issue privately to the maintainer through the contact method listed at albahri.org, rather than publishing working exploit details in an issue.