Codex
Runtime leak protection and log redaction for Codex. Give Codex real secrets while redacting them from output, terminals, and agent transcripts.
Prerequisites
Install the Codex CLI to get the
codex command.
$ npm install -g @openai/codex
$ codex --version1. Install
Get the Dotenvx CLI.
$ curl -sfS https://dotenvx.sh | sh2. Add your secrets
Add a secret to your
.env file.
$ echo "HELLO=World" > .env3. Run Codex with redaction
Runtime leak protection: Codex gets real secrets, while log redaction strips them from its output.
$ dotenvx run --redact -- codex exec 'Run `dotenvx get HELLO` and echo back just Hello VALUE' --skip-git-repo-check
Hello [REDACTED]