Client-side hook model is bypassable and exposes data at the endpoint

Open

#2 opened on Jun 22, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 5/5
Estimated time: Over a week
Newbie friendliness: 25/100

Issue type: Feature
Clarity: Needs clarification
Activity status: Quiet
Tech stack: python
Domain: security

Research direction

No files, tests, or entry points are named. Start by reviewing the Codex hook integration boundary and how prompts reach the client, then establish the intended enforcement point. Done should be an agreed design that addresses client-side bypasses and prevents sensitive data from reaching the client.

Written by the indexing model from the issue text.

Description

discussion security

Context

All Codex hooks execute client-side ("in the GUI").

Problems

Data is already at the client when hooks run — even a successful block is too late, and the payload could be captured by a malicious or competing hook written by a bad actor.
Stop's enforcement is merely "you can no longer send prompts in this chat" — trivially bypassed by clicking new chat.

Analogy

This is client-side JS validation vs. a server-side WAF. Client-side means anyone can alter the logic — and the sensitive data has already reached the browser either way.

Impact

Client-side hooks are defense-in-depth at best, not a sound prevention/deterrence model for PII or harmful content.

Raised by a collaborator during Codex hook integration review.

Dominant language: Python
Stars: 1
Forks: 1
PR merge metrics: No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

slack-gif-creator: validate_gif() multiplies the last frame's duration by the frame count, so reported duration/fps are wrong (1.0s GIF reported as 1.8s) Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

anthropics/skills#1811 · 1 comment · Opened Sep 23, 2026
App fails to start with gradio 6 (allowed by `gradio>=5.49.1`) Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

speaches-ai/speaches#678 · Opened Sep 23, 2026
ModuleNotFoundError: No module named 'mcp.server.fastmcp'. Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

datalayer/mcp-compose#42 · Opened Sep 23, 2026
import spacy fails with ModuleNotFoundError: No module named 'click' Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

conda-forge/spacy-feedstock#177 · Opened Sep 23, 2026
humaneval: extract_function_body corrupts a fenced body-only reply, so the same correct code scores INCORRECT fenced and CORRECT unfenced Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

UKGovernmentBEIS/inspect_evals#2523 · Opened Sep 23, 2026

More Python issues