Access control. Data isolation.

Platform & trust

• Email and password sign-in. Sign-up is closed: the first admin is claimed with a setup token, every other account joins through an expiring invite link an admin creates.
• Admin / member roles; admins can disable or delete accounts, and the last active admin cannot be removed.
• One codex app-server runtime per user, run inside bubblewrap with only that user's writable roots; a seccomp profile applies at the container level.
• Per user: own workspace, CODEX_HOME, MCP servers, skills, plugins, and model providers. Every file path is confined to the caller's own workspace; symlinks to other users are refused.
• Git credentials are sealed with AES-256-GCM before storage. Codex never sees Git tokens: push/pull goes through a platform Git MCP server whose token dies with the runtime.
• Secrets are never returned to the browser or written to logs. Deleted projects go to trash and can be restored; deleting an account runs a durable purge job.
• Built on the OpenAI Codex CLI · Bun · Hono · React · PostgreSQL.