BusyBar Codex connects only to:

• the BUSY Bar address configured by the user; and
• a Chrome DevTools Protocol endpoint bound to 127.0.0.1 in the local Codex desktop process.

The project does not expose a network server, relay prompts, read conversation bodies, or log API credentials. Keep .env and .env.local private; both are ignored by Git.

The loopback debugging endpoint can inspect the signed-in Codex renderer while the controller runs. Do not change its bind address from 127.0.0.1, and do not expose the port through a tunnel or port-forward.

Please use GitHub's private security advisory flow instead of opening a public issue with exploit details.