Tools
`codex doctor` was echoing config values, credentials included, into diagnostic reports
openai/codex PR #46962 (merged 2026-09-21) replaces raw error strings from `config.load` failures with typed metadata, because configuration load errors could echo configuration values straight into a diagnostic report that users routinely paste into bug threads. The new behavior reports file, line and column when a `ConfigLoadError` is available — including when wrapped in an I/O error — and otherwise only the I/O error kind or a generic failure. Regression snapshots cover malformed user and project config, an unknown model provider and invalid header config, asserting both tested JSON reporting modes omit the test credentials.
Source
↳ Follow the thread