Keep the defaults on: the sandbox, approvals, network off and cached search hold up well against injection; most incidents start where someone turned one of them off.
Treat what Codex loads as code:.codex/, AGENTS.md, .env, MCP entries, hooks and .git/config all run or instruct, so review them like a pull request before trusting a project.
Deny what the sandbox doesn’t: the sandbox limits writes and network, so secrets stay readable until a permission profile denies them.