Update: As far as I understand, this was already available as a Codex plugin. The main news is that OpenAI has now open-sourced it, and development is still moving quickly.
Codex Security
21–30 of 257 posts
Re: Codex Security
#22Hey HN, Michael here, co-founder of Promptfoo and one of the people working on the Codex Security CLI at OpenAI. Thanks for checking this out and for flagging the auth issues. We just open-sourced it, and there's still plenty for us to improve. Expect the product to evolve quickly. If you try it, I'd really appreciate hearing what works well and what you think we should improve. Happy to answer questions here. CLI do…
When would I use this over the plugin in codex? Which I think can be invoked from cli as well
Re: Codex Security
#23Hey HN, Michael here, co-founder of Promptfoo and one of the people working on the Codex Security CLI at OpenAI. Thanks for checking this out and for flagging the auth issues. We just open-sourced it, and there's still plenty for us to improve. Expect the product to evolve quickly. If you try it, I'd really appreciate hearing what works well and what you think we should improve. Happy to answer questions here. CLI do…
When would I use this over the plugin in codex? Which I think can be invoked from cli as well
The plugin, including when invoked through the Codex CLI, is great for scanning the repo you're currently working in. The standalone Security CLI/SDK uses the same scanner, but is built for running security across many repos over time: org-wide scans, historical results, deduplication, false-positive tracking, budget controls, and CI integration.
We've been talking to hundreds of engineering and security teams, and their feedback is shaping what we build.
Like Promptfoo, our goal is practical tooling that fits into the workflows teams already have.
Re: Codex Security
#24security tools from AI companies feel like fire departments run by arsonists. useful, sure, but you can't help noticing who benefits from all the fires
Re: Codex Security
#25be careful , your code will go to the cloud/ai using this
Re: Codex Security
#26How does it work? Does the tool upload code to ChatGPT for analysis? That may not be allowed for some corporate projects.
Re: Codex Security
#27I don't think there's much to this other than it being a convenient CI wrapper around their existing models? Edit: there's a little bit more meat here: https://github.com/openai/codex-security/tree/main/sdk/types...
All of codex is a wrapper around their models. There’s still value in a purpose-built harness.
Re: Codex Security
#28Hey HN, Michael here, co-founder of Promptfoo and one of the people working on the Codex Security CLI at OpenAI. Thanks for checking this out and for flagging the auth issues. We just open-sourced it, and there's still plenty for us to improve. Expect the product to evolve quickly. If you try it, I'd really appreciate hearing what works well and what you think we should improve. Happy to answer questions here. CLI do…
Does it require hitting OpenAI's APIs or can one also stand up a local OpenAI compatible LLM endpoint?
Re: Codex Security
#29How does it work? Does the tool upload code to ChatGPT for analysis? That may not be allowed for some corporate projects.
Amazon bedrock is an option for gpt models that does not send your data to openai.
Re: Codex Security
#30I seem to have gotten a bunch of you are trying to stuff we don't allow errors.. very annoying. Can they explain what types of projects it works on and how does it check I own it? Like will it just not work on Linux kernel even on my own patches to it?