What changed
Headroom 0.36.4 changed its proxy to validate caller-supplied upstreams on every resolution path. The same release preserved Codex additional-tools payloads and corrected streaming behavior; 0.36.5 followed later on 22 August with ChatGPT-auth detection and Claude-routing diagnostics, making 0.36.5 the current patched line for this dated event.
Why it matters
Headroom can sit between coding agents and model providers while handling prompts, tool output, memory, and credentials. Incomplete upstream validation at that boundary can route sensitive traffic somewhere operators did not intend, even though the release does not describe a demonstrated exploit.
What to do
Upgrade to at least 0.36.5, inventory every custom upstream and wrapper configuration, and test rejection of unapproved hosts, loopback or private addresses, redirects, and DNS changes. Review recent proxy logs and rotate provider credentials if untrusted users could control upstream configuration.
Caveat
The release notes label the change as a security fix but publish no CVE, advisory, affected-version floor, severity, proof of exploitation, or complete threat model. The recommended boundary tests are defensive validation, not evidence that a specific deployment was compromised.