Security fixes are applied to the latest tagged release. The main branch may contain unreleased changes and is supported on a best-effort basis. Older releases are not maintained unless a release note explicitly says otherwise.

Please use the repository's private Report a vulnerability form under the Security tab. Include:

• the affected version and operating system;
• the smallest reproducible example;
• the expected and observed behavior;
• the potential impact; and
• any suggested mitigation, if known.

Do not include credentials, session transcripts, access tokens, or other private data in a report. Use synthetic values in reproductions. Please do not open a public issue for an unpatched vulnerability.

Maintainers will acknowledge a complete report as soon as practical, keep the reporter informed while it is investigated, and coordinate disclosure after a fix or mitigation is available.

This is the property that matters most about this tool, so it is stated before the boundaries rather than after them.

A transcript contains, verbatim, everything that entered the source session: pages the agent fetched, files it read, command output, error text, issue bodies, dependency READMEs, filenames. Any of that can carry text addressed to a model. Moving it into another agent's native session is the whole point of the bridge, and it is also a trust-boundary crossing: material that sat inertly as tool output on one side can arrive on the other in a position that reads with more authority.

What the bridge does about it:

• A provenance preamble goes first. The transferred session opens with a message saying that this is a transferred transcript, that priority does not change, and that content and tool output remain data rather than instruction. It is prepended before any transferred message, so a model reading in order is warned before it reaches anything hostile.
• Tool material is dropped by default. --tools compact keeps the shape of the conversation without replaying tool results. --tools full retains them, and the trade is explicit: more context, and content the source runtime marked as tool output no longer carries that marking in the destination.
• Untrusted values are encoded, not interpolated. Repository-derived strings — branch names, paths, filenames, status lines — are JSON-quoted and escaped before they reach the rendered handoff, so a crafted filename cannot open a heading or close a wrapper.
• Secret redaction is best effort and is not a confidentiality boundary. Pattern matching catches recognisable token formats. Arbitrary credentials, proprietary source, personal data and anything encoded will be copied verbatim into the destination session file. Transfer sessions you would be willing to hand to the other vendor, because that is what you are doing.

What it cannot do: distinguish an assistant quoting hostile text from an assistant asserting it. If the source agent read an injected instruction and repeated it in its own answer, that sentence stays an assistant turn on the other side. Provenance is preserved where the format carries it; it cannot be reconstructed where it was already lost.

The ask subcommand takes the opposite default: it sends one question, runs the other agent read-only, and wraps any --data payload in a delimiter with a per-call random marker, refusing to send if the payload already contains it.

Claude Code and Codex session formats are vendor-owned and may change without notice. A format compatibility failure is not automatically a security issue, but any behavior that exposes secrets, writes outside the intended session directory, corrupts an existing session, or bypasses an approval boundary should be reported privately.

The bridge should be tested with isolated configuration directories and synthetic transcripts. Never attach a real production transcript to a public bug report.