--- title: OpenAI just open-sourced Codex Security | daily.dev description: OpenAI has released Codex Security, a CLI and TypeScript SDK for scanning code repositories for security vulnerabilities. It supports finding, validating, and... canonical: https://daily.dev/posts/openai-just-open-sourced-codex-security-ybxjtvfim twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OpenAI just open-sourced Codex Security | daily.dev og:description: OpenAI has released Codex Security, a CLI and TypeScript SDK for scanning code repositories for security vulnerabilities. It supports finding, validating, and... og:url: https://daily.dev/posts/openai-just-open-sourced-codex-security-ybxjtvfim og:image: https://api.daily.dev/og/posts/yBXjTVFim.png og:image:alt: OpenAI just open-sourced Codex Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OpenAI just open-sourced Codex Security **[Hacker News](https://daily.dev/sources/hn)** · 2 min read · 0 upvotes · 0 comments ## Summary OpenAI has released Codex Security, a CLI and TypeScript SDK for scanning code repositories for security vulnerabilities. It supports finding, validating, and fixing issues, tracking findings over time, and integrating into CI pipelines. It requires Node.js 22+ and Python 3.10+, and can authenticate via ChatGPT sign-in or an OpenAI API key. A minimal TypeScript SDK is also available for programmatic use. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 1 discussion and 220 comments across hackernews (as of 2026-08-04). **TL;DR:** The community is cautiously interested in OpenAI's Codex Security CLI but quickly ran into real pain points: auth failures at launch, runaway API costs with no resume capability, and mandatory code upload to OpenAI's servers. The co-founder was actively present and responsive, which softened some criticism. **Sentiment:** 35% positive · 45% mixed · 20% skeptical **The case for** - The tool is open-source and the co-founder was actively responsive to issues in the thread. - It supports org-wide scans, CI integration, deduplication, and false-positive tracking beyond what the in-app plugin offers. - The underlying scanner is the same as the Codex plugin, giving it a known baseline of capability. - Local/alternative model endpoint support is planned, which would address cost and privacy concerns. **The pushback** - Auth failures hit users immediately at launch, making the tool unusable out of the box. - Scans can drain significant API quota (one user lost half their weekly Pro usage; another claimed 5 years' worth in 5 minutes) with no resume capability if interrupted. - Code is sent to OpenAI's servers, which is a non-starter for many corporate codebases. - Model guardrails can refuse to explain found vulnerabilities, limiting usefulness for legitimate defensive work. - No progress indicator or token usage display during long-running scans. - The tool does not support local or OpenAI-compatible endpoints yet. **By community** - hackernews (mixed): Developers are intrigued by the concept and appreciate the open-source release and founder engagement, but are frustrated by launch bugs, high unexpected costs, lack of resume support, and mandatory cloud code upload. **Hottest debate:** Whether sending source code to OpenAI's servers is acceptable, and whether local/alternative model endpoints will ever be properly supported. **Open questions** - Will local or OpenAI-compatible LLM endpoints be officially supported, and when? - How can users resume a partially completed scan after an interruption? - Will there be better cost controls and real-time progress/token-usage feedback during scans? - How does the tool handle model guardrail refusals for legitimate open-source security work without requiring special Daybreak/TAC1 access? **Highlights** > Just ran it on a small repo. It ran for almost an hour and then got interrupted. It drained half my weekly usage on a Pro plan. npx codex-security scan . [00:00] Preparing scan [00:00] Authentication: stored Codex credentials. [00:03] Preparing scan [01:20] Running scan [01:20] Preflight: worker delegation supported (up to 8 worker slots). [52:47] Running scan codex-security: Could not save the Codex Security scan: Repository HEAD changed while the scan was running. Start a new scan. codex-security: Partial output was kept at ... > — [gregwebs on hackernews · 7 comments](https://news.ycombinator.com/item?id=49090872) > Oof, that's a bad outcome. Half your weekly usage and a 50-minute scan just to get a HEAD error at the end is not acceptable. --max-cost can help limit estimated spend, but that doesn't fix the underlying problem or give you your quota back. We need to handle a changing checkout and partial results much better. Sorry you ran into this. Please send me an email. > — [dangelosaurus on hackernews · 1 comments](https://news.ycombinator.com/item?id=49091391) > Damn. Just ran it and it used 5 years worth of Pro usage in 5 minutes. If ya wouldn't mind crediting me a quick 60 months that would be great. > — [alasano on hackernews](https://news.ycombinator.com/item?id=49092036) > In short, this isn't an offline scanner. The CLI runs locally but the code and context needed for analysis are sent to the hosted model (OpenAI). For API, Business, and Enterprise accounts, business data isn't used to train models by default. Retention and other data controls depend on the product and account configuration. If your company doesn't allow source code to leave its environment, you shouldn't run this against that codebase. Local and third-party endpoints aren't officially supported yet, but you can read through the code and your favorite coding agent will allow you to use it with any model of your choice in 30 seconds. More on OpenAI's enterprise data handling: https://openai.com/enterprise-privacy/ > — [dangelosaurus on hackernews](https://news.ycombinator.com/item?id=49091800) > > co-founder of Promptfoo and one of the people working on the Codex Security CLI at OpenAI. > Thanks for checking this out and for flagging the auth issues. Offtopic, but this right here is why I don't believe any marketing around "great amazing models that one-shot everything and programmers are no longer needed". You just have to look at what these labs routinely produce, and their own products. Edit to respond to @simonw whose comment I saw before he retracted it ;) This comment is tied directly to consistent continuous claims by the LLM labs. Their own products disprove their own claims, and it would indeed be nice if fewer people believed them :) > — [troupo on hackernews](https://news.ycombinator.com/item?id=49090667) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49089755) · 305 points · 220 comments ## Similar posts on daily.dev - [Codex CLI: OpenAI's Open Agent Harness — Installation, Commands, and CI Integration](https://daily.dev/posts/codex-cli-openai-s-open-agent-harness-installation-commands-and-ci-integration-sl98jxtwh) · SitePoint · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#typescript](https://daily.dev/tags/typescript), [#openai](https://daily.dev/tags/openai), [#openai-codex](https://daily.dev/tags/openai-codex) [View this post on daily.dev](https://daily.dev/posts/openai-just-open-sourced-codex-security-ybxjtvfim) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OpenAI just open-sourced Codex Security","url":"https://daily.dev/posts/openai-just-open-sourced-codex-security-ybxjtvfim","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/openai-just-open-sourced-codex-security-ybxjtvfim"},"datePublished":"2026-07-28T21:41:56.611Z","dateModified":"2026-08-04T12:40:49.745Z","description":"OpenAI has released Codex Security, a CLI and TypeScript SDK for scanning code repositories for security vulnerabilities. It supports finding, validating, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/57719fa70da5363afbbd72edd94e638e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/57719fa70da5363afbbd72edd94e638e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/openai-just-open-sourced-codex-security-ybxjtvfim","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,typescript,openai,openai-codex","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"OpenAI just open-sourced Codex Security"}]} ```