Claudex runs developer tools with the permissions of the logged-in OS user. Its private Unix socket and state permissions limit access by other users; they do not isolate it from code or agents already running as the same user. Write ownership is scheduling coordination, not a sandbox. Use the official Codex sandbox and separate worktrees for the isolation they provide.

The public default is workspace-write with approval handling. Dangerous mode is an explicit opt-in to unsandboxed execution without permission prompts. Read task briefs and use only trusted projects when granting that mode.

Claude models execute only in the official Claude Code CLI. Claudex does not extract Claude credentials, proxy subscription authentication, or call the Anthropic API. Codex authentication remains inside the official Codex process. SSH uses existing authentication and transports task data, not account files.

State, logs, prompts and results can contain private repository content. Keep them out of source control and remove sensitive content before sharing diagnostics. No telemetry is implemented. Network activity comes from the installed official CLIs, requested tools and configured SSH connections.

For a vulnerability, use the repository host's private vulnerability reporting when enabled. Do not post secrets or exploitable account details in a public issue. There is no guaranteed response SLA for this early community project.