Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex Security

github.com

Post reply on HN
Print view View original

191–200 of 257 posts

Re: Codex Security

#191

Post by tomaskafka »

gregwebs wrote: post #41

Just ran it on a small repo. It ran for almost an hour and then got interrupted. It drained half my weekly usage on a Pro plan. npx codex-security scan . [00:00] Preparing scan [00:00] Authentication: stored Codex credentials. [00:03] Preparing scan [01:20] Running scan [01:20] Preflight: worker delegation supported (up to 8 worker slots). [52:47] Running scan codex-security: Could not save the Codex Security scan: R…

On metrics this either shows as “codex security makes people use us more” or “people are buying extra plans, yay!”

Promotions all around.

Re: Codex Security

#192

Post by matheusmoreira »

ryanto wrote: post #145

Hey looks cool. I tried to run this on a small oss library and here's what happened: $ codex-security scan . [00:00] Preparing scan [00:00] Authentication: stored Codex credentials. [00:01] Preparing scan [00:42] Running scan [00:42] Preflight: worker delegation supported (up to 8 worker slots). [41:03] Running scan codex-security: This content was flagged for possible cybersecurity risk. If this seems wrong, try rep…

I was going to switch to OpenAI and away from Anthropic because of "safety" nonsense like this. Really disappointed to discover it's just gonna be more of the same. Looks like Chinese models are the only ones without any of this safety bullshit.

Re: Codex Security

#194

Post by matheusmoreira »

theplumber wrote: post #121
dangelosaurus wrote: post #71

Earlier quoted context omitted.

Thanks! You've run into a real limitation: the CLI doesn't bypass the model's cybersecurity guardrails. If GPT-5.6 Sol finds a vulnerability but refuses to explain it, switching from the Codex app to the CLI won't automatically fix that. For authorized defensive work, Trusted Access for Cyber (TAC1/Daybreak) can reduce refusals depending on the model and the account or organization where access is provisioned. It isn…

>> For authorized defensive work, Trusted Access for Cyber (TAC1/Daybreak) can reduce refusals Or perhaps a better option is to use something like Kimi K3 and cancel the GPT subscription altogether.

Sounds like that's the only solution. I'm so sick of this safety nonsense I was going to switch from Anthropic to OpenAI because of it. I'm so disappointed to see it's just more of the same.

Model finds a vulnerability in your code but "refuses" to tell you. Words can hardly express the sheer absurdity of it.

Re: Codex Security

#195

Post by tesnorindian »

tantricked wrote: post #178

What's the difference between using this and just asking Codex itself to review a codebase for security issues?

This bundles with 13 security skills. Hard coded to gpt-5.6-sol unlike Codex. Runs in an isolated sandbox via a cloned home directory.

Re: Codex Security

#197

Post by latexr »

Quarrelsome wrote: post #47
luciana1u wrote: post #24

security tools from AI companies feel like fire departments run by arsonists. useful, sure, but you can't help noticing who benefits from all the fires

comment feels like someone complaining about being offered a fireproofing solution in the age of flamethrowers.

That’s exactly what they’re saying. With the added (and very important) detail that the people selling the fireproofing are the the same who armed everyone with flamethrowers. Why shouldn’t someone complain about that?

Re: Codex Security

#198

Post by latexr »

punnerud wrote: post #146

Not often I see companies referring to HN, thanks “ We quietly released the open-source Codex Security CLI, but Hacker News found it before we had a chance to share it here…” https://x.com/openai/status/2082263717916586117?s=46&t=mnfnj...

> Not often I see companies referring to HN, thanks

I’m confused. Why are you thanking them for that?

Re: Codex Security

#199

Post by tesnorindian »

krater23 wrote: post #51
bakigul wrote: post #20

Earlier quoted context omitted.

Why would a few code snippets put Snyk out of business?

I don't understand why Snyk is IN business in any way. Who really wants to upload his own code to a company that is specialized at searching security issues? How can I trust that they show me all findings they have instead of selling the best ones to some three letter organisations?

Our employer uses it unaware of its links.

Re: Codex Security

#200

Post by Pooge »

computerex wrote: post #97
schrodinger wrote: post #90

Quick tangent if you’re willing to humor me… I've been noticing that many new projects that would have been written in Python or Node a year ago are starting to be written in Go, Rust, etc. Theory: people realized there’s little benefit to Python for agents. As Zep wrote, an “agent is a long-running, concurrent, I/O-bound process that spends most of its time waiting on a model, a tool, or a human[1]” — not a particul…

I think it's because python is far more approachable/ubiquitous than go/rust. It's the entry level language for many people from all disciplines of life. Scientific community uses it, data science uses it. Golang/rust however are very convenient to distribute. Small, portable, fast exe's are very nice. With agentic coding golang/rust are now accessible to a lot more people.

> python is far more approachable

I see where you're coming from, but to be honest I respectfully disagree. If all you mean to do is writing small one-off scripts then sure Python may be the right tool[1], but when you're doing something more complicated Go is just simpler. And for an LLM, Go is even better for all the reasons mentioned in sibling comments and OP.

[1]: I tend to rely more on Bash, though...

Post reply on HN