Understand the boundaries

Security and privacy

This is a single-owner, self-hosted context reader. Source availability and passing tests do not constitute an independent security certification. Do not offer it as a multi-user hosted service without designing and reviewing tenant isolation, resource limits and operational controls for that use.

Authentication is not included in the public repository

Each deployment needs its own Auth0 tenant/client configuration, bridge login identity and HTTPS tunnel. The resource server verifies the token's signature, issuer, audience, expiry, required scopes and original sub claim against one locally configured owner. ChatGPT login alone does not authenticate this bridge.

The local server does not need an Auth0 management token, OAuth client secret, OpenAI API key, ChatGPT password or browser cookie. If your selected OAuth client requires a client secret, enter it only in that client's private ChatGPT configuration. The Cloudflare connector needs its own tunnel token stored in an owner-readable file outside the checkout.

Keep .env, tokens, keys, tunnel configuration, link grants, browser storage, private verification screenshots and logs out of Git. .gitignore is a guardrail: it does not remove files already committed. Review staged files and history before any publication. Never publish personal configuration as an example.

Context authorization

• Context is disabled by default. bridge:probe allows synthetic checks and authored workflows; context calls additionally require bridge:context.
• A local command links one stored Codex task to the exact real path of its Git repository root. The task's working directory must match that root.
• Links are bound to owner and host, expire after at most 24 hours and can be revoked locally. Grants are stored in an owner-only directory and files.
• The service checks grants before and after reads. Conversation cursors are short-lived, bounded in-memory snapshots tied to the same link.
• Revocation prevents future reads. It cannot delete content already returned to ChatGPT, pasted elsewhere or retained by a receiving service.

What can leave the computer

Permitted visible task text, repository filenames, branch/commit identifiers, source excerpts, changes and project instructions can be returned to ChatGPT. Link CLI output includes the task ID and local path; keep that output private and provide the link ID only to your intended authenticated conversation.

The reader admits tracked files and individually approved untracked files, subject to the same exclusions. It rejects ignored paths, common credential names, paths outside the root, symlinks, hard-linked file content, binary data and oversized content. Path inventory can still list such content-ineligible entries after path-based exclusions; bounded page comparisons count them as omitted and never return their bytes. Missing paths and unreadable search results are omitted. These filters reduce exposure; they cannot recognize every secret or private business detail embedded in an otherwise permitted source file or message. Redaction is explicitly best-effort. A linked repository is a read grant over all its permitted files, not just the first file requested.

Optional allowedPaths stored in a local grant further narrows repository access. Exact files and trailing-slash directory prefixes are supported, with no glob expansion. The MCP caller cannot supply or widen this field. Omission preserves legacy grant behavior; explicit empty/invalid lists fail closed. Ignored and denied names are checked independently, even for allowed paths and individually approved untracked files. File scope does not filter conversation history. Revoke old broad links when replacing them with restricted ones.

Environment exclusions include .env, its dot/hyphen/underscore variants, .envrc and suffixed names such as production.env; .env.example is denied too. Normal source modules such as src/env.ts remain eligible. No process environment reader or shell tool is exposed. Use a reviewed placeholder configuration document instead of exporting real values.

Recognized credential values and URI user information are redacted in visible messages and permitted file content. Full file versions are redacted before pagination or diff generation, preventing partial excerpts from escaping a recognized multiline secret. Newline counts are preserved for file references. Redaction still cannot recognize arbitrary encodings, unnamed secrets or every format; it can also mask legitimate examples. Treat returned text as evidence, not as a byte-identical source backup.

Raw reasoning, system/developer records, raw tool records and attachments are excluded from conversation export. Text a user pasted into a visible message may still be exported. Repository instructions are source material for the receiving agent; they do not supersede that agent's higher-priority rules.

The adapter runs fixed local Git reads and codex app-server to access stored task data. It exposes no generic command execution or write tool to MCP callers. Use repositories you control: this is not a hardened sandbox for hostile local filesystem mutation, malicious executables on PATH or a compromised OS account.

Change discovery hashes bounded, validated file snapshots against Git blob IDs. Diff generation reads the HEAD blob by object ID and compares private temporary redacted copies in an isolated Git repository with no inherited hooks or filter commands. It does not pass the mutable source filename to Git's comparison pipeline. Temporary directories are owner-only and removed after success or failure; abrupt process termination can leave private temporary files for local cleanup. Raw comparisons can differ from normal Git status when clean filters or line-ending conversion would change file content. Lazy object fetching and replacement refs are disabled. A missing baseline object causes a read failure; the bridge does not fetch it or update the linked object store. Partial-clone operators must obtain needed objects separately. The lazy-fetch guard is also a mandatory command-line option, so Git versions that do not recognize it fail before a repository operation can proceed.

Network boundary and operations

Only expose the production entrypoint through HTTPS. It binds to loopback, requires OAuth for MCP calls, and exposes health, discovery and card assets without task content. Do not tunnel the development server or expose local configuration helpers. Avoid storing request bodies or bearer headers in reverse-proxy logs. Cloudflare carries the HTTPS traffic; Auth0 handles the login; ChatGPT receives retrieved context. Configure those providers under your own data and account requirements.

The starter has bounded reads and requests, but no deployment-level rate limiter or operational SLO. Configure appropriate edge abuse controls and monitor a public endpoint. Stop the bridge/tunnel and revoke links when access is no longer needed. Patch dependencies deliberately and rerun the checks before upgrading an exposed instance.

Reporting a vulnerability

Do not post credentials, private task text or a live target's details in a public issue. Use GitHub's Report a vulnerability feature if enabled on this repository. If it is unavailable, open a minimal issue requesting a private contact channel without the exploit details or sensitive data. Use synthetic fixtures for public reproduction. No response-time commitment is implied.