Relax aggressive configuration file pruning

What version of Codex is running?

0.34.0 (retested on 0.36.0)

Which model were you using?

gpt-5-high (retested on gpt-5-codex-high, in a quick test codex version was even more aggressive, trying to break a Lovable app by removing configuration)

What platform is your computer?

WSL Ubuntu

What steps can reproduce the bug?

Create .net project with appsettings. Set in appsetting.json some data that might look like a secret but is not. Lets call it:
"ServiceKey":"key-21550300"

Ask it to reorganize the configuration file or just improve the app.

Sooner or later it will remove the key. When pointed out it did it because of security. It might even add a yet another configuration file and say I must put it here but he won't do it. It also often creates complex structures where it first check Environment variables. With very slight encouragements we might have 5 optional places to store configuration.

What is the expected behavior?

It is great to point out potential security issues, but it should not delete configuration or refuse to recover configuration. It seems to be unable to reliable to understand what are secrets.

What do you see instead?

It remove the configuration. This is inconvenient for the developer. What it tries might even make things worse:

• it removes stuff that is a common configuration
• it might make the app use Env variables, but another app on that machine might have already set them. Now the new app is using secrets from another app!
• If the secrets weren't gitignored, just deleting them from the file hides the fact that they were in github history
• adding another configuration file is exactly the same situation
• Environment variables are not always safer because any app on the machine can read them.

It should be developers choice to know what are secrets and how to protect them. A.I. should only suggest and warn.

Additional information

If I could add my own instructions to system prompt, that would be great. Ideally it would be in my online account, but could be system wide.

This would help with other things, such as advising it not to make frequent mistakes.
eg. don't keep making new Random instances inside the loop with seed 1337 and thus getting the same number every time (use Random.Shared when determinism is not required).