Supported versions are identified only by published codex-substrate-memory releases.

Use this repository's private Security advisories → Report a vulnerability flow. Never open a public issue containing a credential, private history, device code, queue/checkpoint bytes, content-bearing traceback, or exploit detail.

Prefer content-free evidence: plugin/Codex/Python/OS versions, affected lifecycle/tool operation, symbolic failure category, synthetic reproduction, and expected/observed boundary.

• Hosted origin is fixed to https://app.trysubstrate.co; redirects are rejected.
• RFC 8628 device/access credentials are never accepted through MCP arguments or TOML. Custody uses an OS secret service when usable, otherwise owner-private fail-closed storage.
• Codex supplies the hook data root; the MCP launcher accepts it or derives the identical installed-plugin root from CODEX_HOME. The resolved data root, queue, hook state, and checkpoints reject symlinks and require private permissions/ACLs.
• Captured content is bounded and redacted before durable admission. Configured secret values are included in redaction.
• Hook/MCP stdout carries only the documented JSON protocol. Diagnostics are content-free and go to stderr only when explicitly enabled.
• Automatic recall fails closed on the complete canonical entity-quality-v2 capability and item contract.
• Prior-history discovery requires separate durable consent and uses documented bounded app-server APIs; hidden reasoning, subagents, and transcript paths are excluded.

Redaction cannot prove arbitrary sensitive prose absent. Trusted hosted Substrate receives visible content after redaction. A local compromise at the user's privilege level can access owner-readable plugin state. Review changed hook commands through Codex /hooks before trusting them.