OpenAI Codex still lacks a .codexignore to keep secrets out of the model

A still-open feature request (#2847) asks OpenAI’s Codex agent to support an explicit mechanism for marking files and paths the tool must never read or transmit to the model. The proposal calls for a repo-local ignore file along the lines of .codexignore, plus a global user-level equivalent, so teams could keep directories like node_modules searchable for implementation work while categorically blocking secrets such as .env files, .pem certificates, SSH and AWS credentials, and private keys.

The filer stresses that the controls should be deterministic and shareable across a repository and team rather than depending on documentation or informal convention, with support for user defaults layered on top. This is essentially a fail-closed boundary for what an AI coding agent is allowed to ingest — a meaningful gap given that agents routinely traverse a working tree and ship file contents to a remote model.

The request also notes this isn’t new ground: a related issue (#205) raised the same dual concern of preventing sensitive data exfiltration and excluding large or irrelevant files. That earlier thread was closed in favor of the Rust-based codex-rs rewrite, but as of late August 2025 no comparable capability appears to have landed there, prompting this attempt to restart the design discussion.