Privacy/security: git repo URLs which can contain GitHub PAT tokens are sent to OpenAI Responses API without sanitization

What version of Codex CLI is running?

codex-cli 0.142.5

What subscription do you have?

ChatGPT Pro

Which model were you using?

gpt-5.5

What platform is your computer?

Linux 6.17.0-1018-azure x86_64 x86_64

What terminal emulator and version are you using (if applicable)?

_No response_

Codex doctor report

What issue are you seeing?

Codex logs in the session rollout files git repo metadata, without sanitizing the repo URL. GitHub allows using GitHub PAT tokens in the git remote URL:

"git":{
  "commit_hash":"2f7935...",
  "branch":"main",
  "repository_url":"https://github_pat_11AA4UOXQ...@github.com/user/repo.git"
}

crucially, this repository_url is also sent to the OpenAI responses API. Codex analysis:

I do not see redaction of username/password, PAT, query params, or userinfo before it becomes associated_remote_urls.

That raw map is then put directly into WorkspaceGitMetadata.associated_remote_urls and converted directly into TurnMetadataWorkspace.associated_remote_urls. The Responses metadata struct serializes associated_remote_urls as a plain optional BTreeMap<String, String>, and the file explicitly says this metadata snapshot is sent to Responses API via client_metadata["x-codex-turn-metadata"].

There is a sanitizer-like canonicalizer, canonicalize_git_remote_url(), and it does strip userinfo before the host with rsplit_once('@'); the tests include https://token@github.com/openai/codex/ becoming github.com/openai/codex. But crucially, that canonicalizer is not used in the outbound associated_remote_urls path. I only found it used in accepted-lines analytics to compute a repo_hash, where it canonicalizes the remote URL and hashes it rather than uploading that URL directly in that specific event.

So the practical conclusion is:

If your Git remote URL contains a GitHub PAT, current Codex CLI code can send that PAT-containing URL to OpenAI as turn metadata. It is not just local, and I do not see redaction on that path.

What steps can reproduce the bug?

use codex in a git repo

What is the expected behavior?

git repository URL is sanitized to remove usernames, passwords, tokens

Additional information

_No response_