Codex keeps KEY, SECRET, and TOKEN env vars in every shell command unless you opt in
source re-read 2026-10-28
Why this label: Primary claim is OpenAI's own docs (default true). We re-read the Configuration Reference and Advanced Configuration pages on 2026-10-28 and reproduced nothing. Community posts are secondary color only.
- Tried
- Run Codex with API keys and other secrets already exported in your shell (common when keys live in ~/.zshrc or a direnv file).
- Broke
- Any command Codex runs can see those variables. OpenAI's Configuration Reference states that shell_environment_policy.ignore_default_excludes defaults to true and 'Keep[s] variables containing KEY, SECRET, or TOKEN before other filters run.' Community posts the same week reported real setups inheriting the full shell environment until that flag was flipped.
- Cause
- confirmed OpenAI documents ignore_default_excludes defaulting to true: automatic secret-name exclusions are off until you set it to false (Configuration Reference and Advanced Configuration, re-read 2026-10-28).
- confirmed The same docs describe shell_environment_policy as the control for which env vars reach spawned commands, with inherit of all / core / none and optional filters.
- suspected Community posts claim inherit = "all" is what most installs effectively use out of the box. The reference lists the enum but does not spell the unset default in the rows we re-read, so treat that as community report, not a documented default.
- Fix
- In ~/.codex/config.toml add: [shell_environment_policy] ignore_default_excludes = false inherit = "core" That applies the KEY/SECRET/TOKEN name filter and starts from a trimmed core env instead of the full shell. Tighten further with filters or inherit = "none" plus an explicit set map. Docs also show a one-off override: codex --config 'shell_environment_policy.include_only=["PATH","HOME"]'.
- Prevention
- Before trusting Codex on a machine with secrets in the shell profile, open config.toml and confirm ignore_default_excludes is false (or that inherit is core/none with an allowlist). Do not assume secret-looking names are filtered by default.