Evidence record / codex
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-13-codex-ripgrep-deny-glob-expansion-now-ignores-user-configuration
Ripgrep deny-glob expansion now ignores user configuration. User ripgrep configuration, including --quiet in RIPGREP_CONFIG_PATH, could suppress the file list used to build Linux sandbox deny-glob masks and leave matching files accessible. The deny-glob invocation now passes --no-config; protected executable lookup alone did not close this separate hole.
Channel: tagged-release. Half: defect. Date: 2026-10-08 (0.162.0).
Operator consequence: Use 0.162.0 or later and re-test denied reads and writes with RIPGREP_CONFIG_PATH set, checking that permitted files still work.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-codex-ripgrep-deny-glob-expansion-now-ignores-user-configuration
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact