# Dependency Audit
Audited for version 0.1.3.
- `base64`: encodes caller-supplied image bytes as inline data URLs for
dedicated image turns. It performs no network, filesystem, process, or
credential access.
- `serde_json`: encodes and decodes the Codex JSON-RPC protocol. It receives no
credential and performs no network or process IO.
- `tokio`: owns asynchronous process, standard-IO, timeout, and channel
mechanics. It receives no reusable credential.
The Codex executable is an explicit runtime boundary, not a Rust dependency.
This crate removes `OPENAI_API_KEY` and `CODEX_API_KEY` and relies on the
launcher's existing ChatGPT login.