Finding / codex
2026-10-24-codex-preview-proxy-signing-keeps-aws-credentials-in-the-proxy-for-supported-requests
Preview proxy signing keeps AWS credentials in the proxy for supported requests. Alpha.1 adds an aws_sigv4 MITM action that re-signs authorized requests carrying placeholder credentials. Credentials stay in the trusted proxy. Supported forms include empty and explicitly unsigned payloads; incompatible scopes, presigned URLs, unsupported streaming signatures and ambiguous framing are rejected.
Channel: preview-or-beta. Half: capability. Date: 2026-10-23.
Operator consequence: Assess supported AWS request forms before retaining a signing shim. The proxy primitive alone does not supply complete local command/snapshot masking, which remains main-only in section 30.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-codex-preview-proxy-signing-keeps-aws-credentials-in-the-proxy-for-supported-requests
Source links
Primary links, including exact changelog lines when available.