OpenAI Codex CLI: unsafe auto-approval of git commands. The 'safe command' allowlist trusted git subcommands (show/diff/log/branch) by name only, ignoring arguments, so crafted invocations bypassed the approval/sandbox boundary. Vectors: git show/diff/log --output <file> (arbitrary file write); --ext-diff/--textconv/--exec/--paginate and -c core.pager=<cmd> / --config-env (external command execution / argument injection); destructive push/branch/clean forms. Fixed by inspecting git arguments and config overrides so non-read-only invocations require approval. No CVE assigned; vendor paid a high-severity bounty.