Finding / codex
2026-10-13-codex-ripgrep-deny-glob-expansion-now-ignores-user-configuration
Ripgrep deny-glob expansion now ignores user configuration. User ripgrep configuration, including --quiet in RIPGREP_CONFIG_PATH, could suppress the file list used to build Linux sandbox deny-glob masks and leave matching files accessible. The deny-glob invocation now passes --no-config; protected executable lookup alone did not close this separate hole.
Channel: tagged-release. Half: defect. Date: 2026-10-08 (0.162.0).
Operator consequence: Use 0.162.0 or later and re-test denied reads and writes with RIPGREP_CONFIG_PATH set, checking that permitted files still work.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-codex-ripgrep-deny-glob-expansion-now-ignores-user-configuration
Source links
Primary links, including exact changelog lines when available.