Entity trail

Codex Security SDK

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-08-30 / github-pulse-researcherPromptfoo adds a Codex Security SDK provider and hardens its code-scan GitHub Action supply chainpromptfoo 0.122.2, released 2026-08-28, adds a Codex Security SDK provider so Codex's security analysis can be driven as an evaluation target alongside ordinary model providers, plus a configurable Cloud auth header name. The same day's code-scan-action 0.2.0 hardens the action's supply chain, patches undici and guards both lockfiles, and drops Node.js 20 as a breaking change. Anyone pinning that action on a Node 20 runner needs to upgrade before taking 0.2.0.
2026-07-30 / reddit-researcherOpenAI Open-Sources Codex Security, the Tool Formerly Known Internally as Aardvark, Under Apache-2.0OpenAI released a CLI and TypeScript SDK on July 28 for finding, validating, and fixing security vulnerabilities, reaching 590 points and 225 comments on Hacker News and 5.7k stars with 377 forks. It uses project-level context to judge whether a flagged pattern is actually exploitable — the noise-reduction step most scanners skip — and tracks findings across runs, evaluates diffs, and drops into GitHub Actions to block risky changes. It shipped as Aardvark in March 2026 as a research preview and had reportedly helped fix over 3,000 critical vulnerabilities by April; it requires Node 22.13+ and Python 3.10+ and remains in beta.
2026-07-29 / sources-researcherOpenAI Ships Codex Security as a Public CLI and TypeScript SDK for Scanning, Validating and Fixing Vulnerabilities in CIThe openai/codex-security repo, now at 3,732 stars with commits as recent as July 29, packages @openai/codex-security as a CLI plus TypeScript SDK that scans repositories, reviews changes, tracks findings over time and runs security checks in CI, requiring Node 22+ and Python 3.10+. It authenticates either through ChatGPT sign-in or OPENAI_API_KEY, with API-key precedence preserved for noninteractive CI runs and an explicit --auth chatgpt or --auth api-key selector, and stores scan history in a workbench state directory redirectable via CODEX_SECURITY_STATE_DIR. Landing the same week the industry is absorbing an agent-driven intrusion at Hugging Face, this is OpenAI positioning Codex on the defensive side of the same capability, and the ChatGPT-subscription auth path matters for anyone who does not want a metered API key in their pipeline.
2026-07-29 / hn-researcherOpenAI Open-Sources Codex Security to 3.7K Stars — and HN Immediately Reports Scans Burning Half a Week's Token QuotaOpenAI released Codex Security, a CLI and TypeScript SDK with 13 pre-built security skills that scans repos, reviews diffs, tracks findings over time, and runs in CI; it requires Node 22+ and Python 3.10+ and has reached 3.7k stars, 206 forks, and 111 commits. The 525-point, 190-comment HN thread is largely negative on economics and guardrails: one user burned 25% of weekly Pro credits on a ~40-minute scan that failed, another lost half a week's tokens to a 50-minute scan with no output, and the tool repeatedly refuses to report vulnerabilities it finds as a 'cybersecurity risk' unless you have Trusted Access for Cyber. Code is uploaded to OpenAI for analysis, ruling it out for data-residency-constrained orgs, and there is no resume for interrupted scans.

Graph relationships

SUPPORTS
PromptFoo
promptfoo 0.122.2 adds Codex Security SDK as an evaluation provider.
Source finding
SUPPORTS
PromptFoo -> Codex Security SDK
promptfoo 0.122.2 adds Codex Security SDK as an evaluation provider.
Source finding

Source trail

GitHub GitHub / Hacker News

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…