openai / openai/codex-security
Match equivalent findings across Standard and Deep scans
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 10.8k
- Forks
- 801
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 257
Description
Standard and Deep scans of the same repository revision can assign different identity.anchor values to the same vulnerability. Consequently, scans compare may report the previous finding as unknown and the equivalent new finding as newly introduced.
Reproduction: run both scan modes against the same synthetic vulnerable repository, then compare their results.
Expected: equivalent findings with matching vulnerability families and source locations remain identifiable across scan modes.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the scans compare entry point and the code that assigns or compares identity.anchor values. Reproduce the issue by running Standard and Deep scans against the same synthetic vulnerable repository, then compare their results. Done means equivalent findings with matching vulnerability families and source locations remain identifiable across both scan modes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs, typescript
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100