{"url":"https://api.github.com/repos/openai/codex/pulls/39283","id":4308510825,"node_id":"PR_kwDOOYsS4c8AAAABAM6oaQ","html_url":"https://github.com/openai/codex/pull/39283","diff_url":"https://github.com/openai/codex/pull/39283.diff","patch_url":"https://github.com/openai/codex/pull/39283.patch","issue_url":"https://api.github.com/repos/openai/codex/issues/39283","commits_url":"https://api.github.com/repos/openai/codex/pulls/39283/commits","review_comments_url":"https://api.github.com/repos/openai/codex/pulls/39283/comments","review_comment_url":"https://api.github.com/repos/openai/codex/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openai/codex/issues/39283/comments","statuses_url":"https://api.github.com/repos/openai/codex/statuses/2fe4e06cc23bda9d8a719fbcf3d3712e42d450de","number":39283,"state":"closed","locked":true,"title":"Document secure devcontainer DNS exfiltration risk","user":{"login":"copyberry[bot]","id":240088373,"node_id":"BOT_kgDODk91NQ","avatar_url":"https://avatars.githubusercontent.com/in/2173631?v=4","gravatar_id":"","url":"https://api.github.com/users/copyberry%5Bbot%5D","html_url":"https://github.com/apps/copyberry","followers_url":"https://api.github.com/users/copyberry%5Bbot%5D/followers","following_url":"https://api.github.com/users/copyberry%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/copyberry%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/copyberry%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/copyberry%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/copyberry%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/copyberry%5Bbot%5D/repos","events_url":"https://api.github.com/users/copyberry%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/copyberry%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"body":"Document secure devcontainer DNS exfiltration risk\n\n## Why\n\nThe secure devcontainer's firewall does not apply its domain allowlist to DNS\ntraffic, so it does not provide secure DNS resolution for untrusted code.\n\n## What changed\n\nDocument the DNS exfiltration risk, limit the devcontainer recommendation to\ntrusted repositories, and describe filtering DNS through a restricted resolver\nas a partial mitigation. Clarify that allowlisted HTTPS destinations remain a\npossible exfiltration path.\n\n<!-- copyberry-projection-id: dd3e2f192d80a12ee709eefaf79abd54a04f6b4463baa91b68c9eeb76c32296e -->","labels":[],"milestone":null,"active_lock_reason":null,"created_at":"2026-08-18T21:18:52Z","updated_at":"2026-08-18T21:21:18Z","closed_at":"2026-08-18T21:21:07Z","merged_at":"2026-08-18T21:21:07Z","merge_commit_sha":"2fe4e06cc23bda9d8a719fbcf3d3712e42d450de","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"head":{"label":"openai:copyberry/codex-internal-to-codex-oss/73cc7d29f8de17013c01411f8c20b8b5e1199b24","ref":"copyberry/codex-internal-to-codex-oss/73cc7d29f8de17013c01411f8c20b8b5e1199b24","repo":{"id":965415649,"node_id":"R_kgDOOYsS4Q","name":"codex","full_name":"openai/codex","owner":{"login":"openai","id":14957082,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0OTU3MDgy","avatar_url":"https://avatars.githubusercontent.com/u/14957082?v=4","gravatar_id":"","url":"https://api.github.com/users/openai","html_url":"https://github.com/openai","followers_url":"https://api.github.com/users/openai/followers","following_url":"https://api.github.com/users/openai/following{/other_user}","gists_url":"https://api.github.com/users/openai/gists{/gist_id}","starred_url":"https://api.github.com/users/openai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openai/subscriptions","organizations_url":"https://api.github.com/users/openai/orgs","repos_url":"https://api.github.com/users/openai/repos","events_url":"https://api.github.com/users/openai/events{/privacy}","received_events_url":"https://api.github.com/users/openai/received_events","type":"Organization","user_view_type":"public","site_admin":false},"private":false,"fork":false,"archived":false,"disabled":false,"description":"Lightweight coding agent that runs in your terminal","homepage":"","language":"Rust","visibility":"public","is_template":false,"topics":[],"forks_count":20097,"forks":20097,"stargazers_count":128284,"watchers_count":128284,"watchers":128284,"open_issues_count":21318,"open_issues":21318,"size":671190,"default_branch":"main","has_issues":true,"has_projects":false,"has_wiki":false,"has_pages":false,"has_downloads":false,"has_discussions":true,"has_pull_requests":true,"pushed_at":"2026-10-08T06:32:11Z","created_at":"2025-04-13T05:37:54Z","updated_at":"2026-10-08T06:48:04Z","allow_forking":true,"web_commit_signoff_required":false,"pull_request_creation_policy":"collaborators_only","license":{"key":"apache-2.0","name":"Apache License 2.0","url":"https://api.github.com/licenses/apache-2.0","spdx_id":"Apache-2.0","node_id":"MDc6TGljZW5zZTI="},"url":"https://api.github.com/repos/openai/codex","html_url":"https://github.com/openai/codex","archive_url":"https://api.github.com/repos/openai/codex/{archive_format}{/ref}","assignees_url":"https://api.github.com/repos/openai/codex/assignees{/user}","blobs_url":"https://api.github.com/repos/openai/codex/git/blobs{/sha}","branches_url":"https://api.github.com/repos/openai/codex/branches{/branch}","collaborators_url":"https://api.github.com/repos/openai/codex/collaborators{/collaborator}","comments_url":"https://api.github.com/repos/openai/codex/comments{/number}","commits_url":"https://api.github.com/repos/openai/codex/commits{/sha}","compare_url":"https://api.github.com/repos/openai/codex/compare/{base}...{head}","contents_url":"https://api.github.com/repos/openai/codex/contents/{+path}","contributors_url":"https://api.github.com/repos/openai/codex/contributors","deployments_url":"https://api.github.com/repos/openai/codex/deployments","downloads_url":"https://api.github.com/repos/openai/codex/downloads","events_url":"https://api.github.com/repos/openai/codex/events","forks_url":"https://api.github.com/repos/openai/codex/forks","git_commits_url":"https://api.github.com/repos/openai/codex/git/commits{/sha}","git_refs_url":"https://api.github.com/repos/openai/codex/git/refs{/sha}","git_tags_url":"https://api.github.com/repos/openai/codex/git/tags{/sha}","git_url":"git://github.com/openai/codex.git","issue_comment_url":"https://api.github.com/repos/openai/codex/issues/comments{/number}","issue_events_url":"https://api.github.com/repos/openai/codex/issues/events{/number}","issues_url":"https://api.github.com/repos/openai/codex/issues{/number}","keys_url":"https://api.github.com/repos/openai/codex/keys{/key_id}","labels_url":"https://api.github.com/repos/openai/codex/labels{/name}","languages_url":"https://api.github.com/repos/openai/codex/languages","merges_url":"https://api.github.com/repos/openai/codex/merges","milestones_url":"https://api.github.com/repos/openai/codex/milestones{/number}","notifications_url":"https://api.github.com/repos/openai/codex/notifications{?since,all,participating}","pulls_url":"https://api.github.com/repos/openai/codex/pulls{/number}","releases_url":"https://api.github.com/repos/openai/codex/releases{/id}","ssh_url":"org-14957082@github.com:openai/codex.git","stargazers_url":"https://api.github.com/repos/openai/codex/stargazers","statuses_url":"https://api.github.com/repos/openai/codex/statuses/{sha}","subscribers_url":"https://api.github.com/repos/openai/codex/subscribers","subscription_url":"https://api.github.com/repos/openai/codex/subscription","tags_url":"https://api.github.com/repos/openai/codex/tags","teams_url":"https://api.github.com/repos/openai/codex/teams","trees_url":"https://api.github.com/repos/openai/codex/git/trees{/sha}","clone_url":"https://github.com/openai/codex.git","mirror_url":null,"hooks_url":"https://api.github.com/repos/openai/codex/hooks","svn_url":"https://github.com/openai/codex"},"sha":"2fe4e06cc23bda9d8a719fbcf3d3712e42d450de","user":{"login":"openai","id":14957082,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0OTU3MDgy","avatar_url":"https://avatars.githubusercontent.com/u/14957082?v=4","gravatar_id":"","url":"https://api.github.com/users/openai","html_url":"https://github.com/openai","followers_url":"https://api.github.com/users/openai/followers","following_url":"https://api.github.com/users/openai/following{/other_user}","gists_url":"https://api.github.com/users/openai/gists{/gist_id}","starred_url":"https://api.github.com/users/openai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openai/subscriptions","organizations_url":"https://api.github.com/users/openai/orgs","repos_url":"https://api.github.com/users/openai/repos","events_url":"https://api.github.com/users/openai/events{/privacy}","received_events_url":"https://api.github.com/users/openai/received_events","type":"Organization","user_view_type":"public","site_admin":false}},"base":{"label":"openai:main","ref":"main","repo":{"id":965415649,"node_id":"R_kgDOOYsS4Q","name":"codex","full_name":"openai/codex","owner":{"login":"openai","id":14957082,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0OTU3MDgy","avatar_url":"https://avatars.githubusercontent.com/u/14957082?v=4","gravatar_id":"","url":"https://api.github.com/users/openai","html_url":"https://github.com/openai","followers_url":"https://api.github.com/users/openai/followers","following_url":"https://api.github.com/users/openai/following{/other_user}","gists_url":"https://api.github.com/users/openai/gists{/gist_id}","starred_url":"https://api.github.com/users/openai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openai/subscriptions","organizations_url":"https://api.github.com/users/openai/orgs","repos_url":"https://api.github.com/users/openai/repos","events_url":"https://api.github.com/users/openai/events{/privacy}","received_events_url":"https://api.github.com/users/openai/received_events","type":"Organization","user_view_type":"public","site_admin":false},"private":false,"fork":false,"archived":false,"disabled":false,"description":"Lightweight coding agent that runs in your terminal","homepage":"","language":"Rust","visibility":"public","is_template":false,"topics":[],"forks_count":20097,"forks":20097,"stargazers_count":128284,"watchers_count":128284,"watchers":128284,"open_issues_count":21318,"open_issues":21318,"size":671190,"default_branch":"main","has_issues":true,"has_projects":false,"has_wiki":false,"has_pages":false,"has_downloads":false,"has_discussions":true,"has_pull_requests":true,"pushed_at":"2026-10-08T06:32:11Z","created_at":"2025-04-13T05:37:54Z","updated_at":"2026-10-08T06:48:04Z","allow_forking":true,"web_commit_signoff_required":false,"pull_request_creation_policy":"collaborators_only","license":{"key":"apache-2.0","name":"Apache License 2.0","url":"https://api.github.com/licenses/apache-2.0","spdx_id":"Apache-2.0","node_id":"MDc6TGljZW5zZTI="},"url":"https://api.github.com/repos/openai/codex","html_url":"https://github.com/openai/codex","archive_url":"https://api.github.com/repos/openai/codex/{archive_format}{/ref}","assignees_url":"https://api.github.com/repos/openai/codex/assignees{/user}","blobs_url":"https://api.github.com/repos/openai/codex/git/blobs{/sha}","branches_url":"https://api.github.com/repos/openai/codex/branches{/branch}","collaborators_url":"https://api.github.com/repos/openai/codex/collaborators{/collaborator}","comments_url":"https://api.github.com/repos/openai/codex/comments{/number}","commits_url":"https://api.github.com/repos/openai/codex/commits{/sha}","compare_url":"https://api.github.com/repos/openai/codex/compare/{base}...{head}","contents_url":"https://api.github.com/repos/openai/codex/contents/{+path}","contributors_url":"https://api.github.com/repos/openai/codex/contributors","deployments_url":"https://api.github.com/repos/openai/codex/deployments","downloads_url":"https://api.github.com/repos/openai/codex/downloads","events_url":"https://api.github.com/repos/openai/codex/events","forks_url":"https://api.github.com/repos/openai/codex/forks","git_commits_url":"https://api.github.com/repos/openai/codex/git/commits{/sha}","git_refs_url":"https://api.github.com/repos/openai/codex/git/refs{/sha}","git_tags_url":"https://api.github.com/repos/openai/codex/git/tags{/sha}","git_url":"git://github.com/openai/codex.git","issue_comment_url":"https://api.github.com/repos/openai/codex/issues/comments{/number}","issue_events_url":"https://api.github.com/repos/openai/codex/issues/events{/number}","issues_url":"https://api.github.com/repos/openai/codex/issues{/number}","keys_url":"https://api.github.com/repos/openai/codex/keys{/key_id}","labels_url":"https://api.github.com/repos/openai/codex/labels{/name}","languages_url":"https://api.github.com/repos/openai/codex/languages","merges_url":"https://api.github.com/repos/openai/codex/merges","milestones_url":"https://api.github.com/repos/openai/codex/milestones{/number}","notifications_url":"https://api.github.com/repos/openai/codex/notifications{?since,all,participating}","pulls_url":"https://api.github.com/repos/openai/codex/pulls{/number}","releases_url":"https://api.github.com/repos/openai/codex/releases{/id}","ssh_url":"org-14957082@github.com:openai/codex.git","stargazers_url":"https://api.github.com/repos/openai/codex/stargazers","statuses_url":"https://api.github.com/repos/openai/codex/statuses/{sha}","subscribers_url":"https://api.github.com/repos/openai/codex/subscribers","subscription_url":"https://api.github.com/repos/openai/codex/subscription","tags_url":"https://api.github.com/repos/openai/codex/tags","teams_url":"https://api.github.com/repos/openai/codex/teams","trees_url":"https://api.github.com/repos/openai/codex/git/trees{/sha}","clone_url":"https://github.com/openai/codex.git","mirror_url":null,"hooks_url":"https://api.github.com/repos/openai/codex/hooks","svn_url":"https://github.com/openai/codex"},"sha":"681c82f4979ac9dd2fdaded8539b0845ca5f5955","user":{"login":"openai","id":14957082,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE0OTU3MDgy","avatar_url":"https://avatars.githubusercontent.com/u/14957082?v=4","gravatar_id":"","url":"https://api.github.com/users/openai","html_url":"https://github.com/openai","followers_url":"https://api.github.com/users/openai/followers","following_url":"https://api.github.com/users/openai/following{/other_user}","gists_url":"https://api.github.com/users/openai/gists{/gist_id}","starred_url":"https://api.github.com/users/openai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openai/subscriptions","organizations_url":"https://api.github.com/users/openai/orgs","repos_url":"https://api.github.com/users/openai/repos","events_url":"https://api.github.com/users/openai/events{/privacy}","received_events_url":"https://api.github.com/users/openai/received_events","type":"Organization","user_view_type":"public","site_admin":false}},"_links":{"comments":{"href":"https://api.github.com/repos/openai/codex/issues/39283/comments"},"commits":{"href":"https://api.github.com/repos/openai/codex/pulls/39283/commits"},"statuses":{"href":"https://api.github.com/repos/openai/codex/statuses/2fe4e06cc23bda9d8a719fbcf3d3712e42d450de"},"html":{"href":"https://github.com/openai/codex/pull/39283"},"issue":{"href":"https://api.github.com/repos/openai/codex/issues/39283"},"review_comments":{"href":"https://api.github.com/repos/openai/codex/pulls/39283/comments"},"review_comment":{"href":"https://api.github.com/repos/openai/codex/pulls/comments{/number}"},"self":{"href":"https://api.github.com/repos/openai/codex/pulls/39283"}},"author_association":"NONE","auto_merge":null,"draft":false,"merged":true,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":{"login":"copyberry[bot]","id":240088373,"node_id":"BOT_kgDODk91NQ","avatar_url":"https://avatars.githubusercontent.com/in/2173631?v=4","gravatar_id":"","url":"https://api.github.com/users/copyberry%5Bbot%5D","html_url":"https://github.com/apps/copyberry","followers_url":"https://api.github.com/users/copyberry%5Bbot%5D/followers","following_url":"https://api.github.com/users/copyberry%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/copyberry%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/copyberry%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/copyberry%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/copyberry%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/copyberry%5Bbot%5D/repos","events_url":"https://api.github.com/users/copyberry%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/copyberry%5Bbot%5D/received_events","type":"Bot","user_view_type":"public","site_admin":false},"comments":0,"review_comments":0,"maintainer_can_modify":false,"commits":1,"additions":2,"deletions":0,"changed_files":1}