openai/codex-security

View on GitHub

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security

Stars: 10.8k
Forks: 801
Open beginner issues: 0
Indexed issues: 62
Avg merge: 1d 8h
Merged PRs (30d): 257

Dominant language: TypeScript
License: Apache-2.0
Last GitHub push: Sep 19, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: No code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

62 open issues indexed

Surface multiscan run warnings in campaign summaries Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

openai/codex-security#973 · Opened Sep 18, 2026
onWorkerStatus can omit dispatch events when delegated workers run Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

openai/codex-security#956 · Opened Sep 17, 2026
Security audits stop with usage_limit_exceeded before completion; request investigation of retry/resume accounting Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

openai/codex-security#849 · 1 comment · Opened Sep 9, 2026
Concurrent same-version scans replace the shared plugin directory and crash later workers with “os error 2” Open

Difficulty 4/5 3-5 days Newbie friendliness 68/100

openai/codex-security#824 · Opened Sep 8, 2026
Supported recovery for terminal unsealed scan missing findings/coverage scanId envelopes Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

openai/codex-security#790 · 1 comment · Opened Sep 2, 2026
Feature proposal: versioned security scan benchmark corpus Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

openai/codex-security#763 · Opened Aug 31, 2026
Codex Security 0.1.22: finalization resurrects resolved checkpoint deferrals and produces inconsistent durable coverage Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

openai/codex-security#741 · 1 comment · Opened Aug 29, 2026
Successful Deep Scan completion promotes findings from unconsumed worker checkpoints Open

Difficulty 4/5 3-5 days Newbie friendliness 68/100

openai/codex-security#717 · Opened Aug 28, 2026
Deep Scan counts semantic aliases as new findings and resets no-new convergence Open

Difficulty 5/5 Over a week Newbie friendliness 45/100

openai/codex-security#711 · Opened Aug 28, 2026
Feature request: expose headless patch generation through the TypeScript SDK Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

openai/codex-security#681 · Opened Aug 27, 2026
Match equivalent findings across Standard and Deep scans Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

openai/codex-security#669 · 2 comments · Opened Aug 27, 2026
Align Deep Scan worker draft guidance with the MCP input schema Open

Difficulty 3/5 1-2 days Newbie friendliness 66/100

openai/codex-security#668 · 1 comment · Opened Aug 27, 2026
Multi_agent_v2 fails against Bedrock Mantle Endpoint Open

Difficulty 3/5 1-2 days Newbie friendliness 55/100

openai/codex-security#663 · 1 comment · Opened Aug 26, 2026
TypeScript contract loader accepts reversed finding line ranges Open

Difficulty 3/5 1-2 days Newbie friendliness 78/100

openai/codex-security#560 · Opened Aug 18, 2026
Deferred coverage paths bypass canonical repository-relative validation Open

Difficulty 3/5 1-2 days Newbie friendliness 74/100

openai/codex-security#557 · Opened Aug 18, 2026
Saved scan logs include same-thread events emitted after scan completion Open

Difficulty 3/5 1-2 days Newbie friendliness 75/100

openai/codex-security#555 · Opened Aug 18, 2026
Failed or inconsistent config-preflight commands can report worker capacity Open

Difficulty 3/5 1-2 days Newbie friendliness 74/100

openai/codex-security#553 · Opened Aug 18, 2026
Interactive login metadata accepts external plaintext HTTP URLs Open

Difficulty 3/5 1-2 days Newbie friendliness 74/100

openai/codex-security#550 · Opened Aug 18, 2026
Path-target preflight accepts special files that scan setup later rejects Open

Difficulty 3/5 1-2 days Newbie friendliness 74/100

openai/codex-security#548 · Opened Aug 18, 2026
Repository index cannot return unscanned targets Open

Difficulty 3/5 1-2 days Newbie friendliness 74/100

openai/codex-security#546 · Opened Aug 18, 2026
Windows activity paths are dropped when repository casing differs Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

openai/codex-security#544 · Opened Aug 18, 2026
Canonical code-evidence paths bypass repository-relative path validation Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

openai/codex-security#541 · Opened Aug 18, 2026
Bulk-scan wizard drops cancellation while waiting on interactive prompts Open

Difficulty 3/5 1-2 days Newbie friendliness 74/100

openai/codex-security#539 · Opened Aug 18, 2026
Knowledge-base cancellation is ignored once PDF extraction starts Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

openai/codex-security#531 · Opened Aug 18, 2026
Selected profile cannot relax a root `approval_policy = "never"` Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

openai/codex-security#528 · Opened Aug 18, 2026
Code-fenced status markers can be reported as live scan progress Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

openai/codex-security#525 · Opened Aug 18, 2026
Linear API keys are not recognized by the shared error redactor Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

openai/codex-security#521 · Opened Aug 18, 2026
Scan matching drops repeated stable findings from earlier scans Open

Difficulty 3/5 1-2 days Newbie friendliness 70/100

openai/codex-security#518 · Opened Aug 17, 2026
Linear project import can loop after the first page of issues Open

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

openai/codex-security#516 · Opened Aug 17, 2026
Working-tree diff findings can show source excerpts from HEAD instead of scanned changes Open

Difficulty 3/5 1-2 days Newbie friendliness 76/100

openai/codex-security#514 · Opened Aug 17, 2026
`snapshot_sqlite.py` hangs when source and destination are the same database Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

openai/codex-security#512 · Opened Aug 17, 2026
Windows deep scans can fail when subprocess output contains non-CP1252 bytes Open

area:python bug platform:windows priority:p2 question status:needs-info

Difficulty 4/5 3-5 days Newbie friendliness 48/100

openai/codex-security#283 · 3 comments · Opened Aug 5, 2026
Deep Security Scan fails terminally when its discovery triggers cyber safety Open

area:auth area:cost area:reports bug priority:p1

Difficulty 4/5 3-5 days Newbie friendliness 38/100

openai/codex-security#276 · 1 comment · 3 reactions · Opened Aug 4, 2026
Are there any plans to support self-built Literm in the future? Open

priority:p3 question status:needs-info

Difficulty 5/5 Over a week Newbie friendliness 20/100

openai/codex-security#257 · 1 comment · Opened Aug 4, 2026
Run warnings never reach the SARIF projection, so drift is invisible to SARIF consumers Open

area:python area:reports bug priority:p1

Difficulty 3/5 1-2 days Newbie friendliness 76/100

openai/codex-security#251 · 2 comments · Opened Aug 4, 2026
bulk-scan discards run warnings, so a drifted repository is recorded as completed with no signal Open

area:bulk-scan area:reports bug priority:p1

Difficulty 3/5 1-2 days Newbie friendliness 76/100

openai/codex-security#248 · Opened Aug 4, 2026
Document npm package, bundled plugin, and runtime version mapping Open

area:cli documentation priority:p3

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

openai/codex-security#234 · 1 comment · Opened Aug 3, 2026
scan.target.remote accepts embedded tab/newline/CR because new URL() strips them before validating Open

area:reports bug priority:p2

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

openai/codex-security#231 · Opened Aug 3, 2026
An unreadable Codex session log fails every cost poll for the rest of the scan, and can fail a scan that succeeded Open

area:cost bug priority:p1

Difficulty 3/5 1-2 days Newbie friendliness 48/100

openai/codex-security#223 · 1 comment · Opened Aug 3, 2026
multiscan cleanup failure masks the scan outcome and skips the repository receipt Open

area:bulk-scan area:reports bug priority:p1

Difficulty 3/5 1-2 days Newbie friendliness 78/100

openai/codex-security#211 · Opened Aug 2, 2026
Windows scan output directories are not ACL-hardened like credential homes Open

area:bulk-scan area:reports area:sandbox bug platform:windows priority:p1

Difficulty 4/5 3-5 days Newbie friendliness 52/100

openai/codex-security#201 · Opened Aug 1, 2026
Python 3.10 is documented as supported, but every documented way to supply the interpreter fails; only an undocumented one works Open

area:cli area:python bug documentation priority:p1

Difficulty 4/5 3-5 days Newbie friendliness 68/100

openai/codex-security#194 · 2 comments · Opened Aug 1, 2026
(0.1.5) scan agent still creates no draft artifacts on GitHub-hosted runners Open

area:cli area:cost area:reports area:sandbox bug priority:p1

Difficulty 4/5 3-5 days Newbie friendliness 38/100

openai/codex-security#191 · Opened Aug 1, 2026
Expose a scan-session artifact index and optional rollout export Open

area:cli area:reports enhancement priority:p3

Difficulty 5/5 Over a week Newbie friendliness 35/100

openai/codex-security#187 · 2 comments · Opened Jul 31, 2026
Detect and warn from HEAD drifting earlier Open

area:cost area:reports enhancement priority:p2

Difficulty 3/5 1-2 days Newbie friendliness 48/100

openai/codex-security#164 · 1 comment · Opened Jul 30, 2026
scans match --all builds unbounded quadratic history payloads Open

area:cli area:cost area:reports bug priority:p2

Difficulty 5/5 Over a week Newbie friendliness 42/100

openai/codex-security#136 · 2 comments · Opened Jul 30, 2026
Malformed complete multiscan receipts permanently block campaign resume Open

area:bulk-scan area:reports bug priority:p2

Difficulty 4/5 3-5 days Newbie friendliness 45/100

openai/codex-security#133 · 1 comment · Opened Jul 30, 2026
Bundled workbench resolves Git from inherited PATH instead of the trusted executable boundary Open

area:python area:sandbox bug priority:p1

Difficulty 4/5 3-5 days Newbie friendliness 52/100

openai/codex-security#129 · 1 comment · Opened Jul 30, 2026
Run without otuput directory hangs computer, with output directory can't write file. Randomly success, randomly failure. Open

area:cli priority:p2 question status:needs-info

Difficulty 3/5 1-2 days Newbie friendliness 35/100

openai/codex-security#108 · 1 comment · Opened Jul 29, 2026
Scan always fails at seal step: `scan-manifest.json: expected a regular file inside the scan directory` — reproducible on Windows AND Linux Open

area:cost area:reports area:sandbox bug priority:p1

Difficulty 4/5 3-5 days Newbie friendliness 45/100

openai/codex-security#73 · 6 comments · 1 reaction · Opened Jul 29, 2026

openai/codex-security

Get new issues in your inbox