{"schema_version":"1.0","service":"Publicasta","type":"article","id":224,"slug":"openai_codex_security_open_source_scanner_2026_07_29","title":"Codex Security ist open source, aber Maintainer sollten genau hinsehen","excerpt":"OpenAIs neuer Security-CLI kann OSS helfen, doch der erste Tag zeigte Zugriff, Kosten, Guardrails und Package-Naming als Risiken.","language":"de","default_language":"en","canonical_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=de","image":{"url":"https://publicasta.com/storage/projects/10/pages/224/2026/07/8de00274-dc50-4a59-84d5-eaea0d1a44f2.webp","alt":"Open-Source-Security-Scanner prüft repository diff und SARIF report"},"publisher":{"id":10,"slug":"open_source_radar","name":"Open Source Radar","url":"https://publicasta.com/open_source_radar"},"author":{"name":"Anton R"},"published_at":"2026-07-29T13:41:15+00:00","updated_at":"2026-07-29T13:41:15+00:00","content_markdown":"OpenAIs Codex Security ist nicht nur deshalb interessant, weil ein weiteres AI-Tool Code nach Schwachstellen durchsucht. Spannender ist der öffentliche Test: Ein Security-Workflow für Maintainer liegt unter Apache-2.0 auf GitHub und wurde sofort von der Open-Source-Community auseinandergenommen.\n\n ![Open-Source-Security-Scanner prüft repository diff und SARIF report](https://publicasta.com/storage/projects/10/pages/224/2026/07/8de00274-dc50-4a59-84d5-eaea0d1a44f2.webp)\n\n Beim Check hatte `openai/codex-security` 3,985 stars, 221 forks, 48 open issues und die Beschreibung “SDKs and CLI for Codex Security”. Der Hacker-News-Thread “Codex Security” kam auf 544 points und 196 comments. Dort ging es schnell um Kosten, Zugriff, Guardrails, lange Läufe und CLI-Probleme.\n\n Das Tool ist ein CLI und TypeScript SDK zum Finden, Validieren und Beheben von vulnerabilities. Die Docs nennen repository scans, path scans, diff scans, working-tree scans, deep mode, knowledge-base context, pre-commit hook, bulk scans, SARIF export und scan history. Als Artefakte entstehen unter anderem `scan-manifest.json`, `findings.json`, `coverage.json`, `report.md`, `artifacts/` und `exports/results.sarif`.\n\n Die Form passt. Maintainer brauchen keine weiteren vagen Warnungen, sondern prüfbare Findings, klare Coverage und Ergebnisse, die in CI passen. Aber Codex Security ist kein eigenständiger lokaler Scanner wie CodeQL, Semgrep, Trivy, Gitleaks oder osv-scanner. Es ist ein Open-Source-Client um einen OpenAI-Dienst. Benötigt werden Node.js 22+, Python 3.10+ für scans/export, ChatGPT login oder `OPENAI_API_KEY`; vollständige Repository-Scans können Trusted Access for Cyber erfordern.\n\n Der erste Tag zeigte Reibung. HN-Nutzer berichteten von langen Scans, Verbrauch von Nutzungskontingent, partial output und refusals durch cyber guardrails. GitHub issue #66 meldete unter Windows 11 ein Problem beim Speichern von `scan-manifest.json`; PR #67 schlug einen Fix vor. Issue #68 war der Lehrbuchfall: README-Beispiele nutzten `npx codex-security`, obwohl das offizielle Paket `@openai/codex-security` heißt. Der unscoped Name existierte auf npm als nicht affiliierter Placeholder.\n\n Urteil: ausprobieren, aber kontrolliert. Nehmen Sie ein eigenes kleines Repository, verwenden Sie `--dry-run`, schreiben Sie Ergebnisse außerhalb des Repos, setzen Sie `--max-cost`, lesen Sie `coverage.json` und vergleichen Sie Findings mit bekannten Scannern. Codex Security kann bei kontextueller Review helfen, ist aber noch ein experimenteller Assistent, kein Ersatz für AppSec.","available_translations":[{"language":"ar","title":"أصبح Codex Security مفتوح المصدر، لكن على maintainers قراءة التفاصيل","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=ar","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=ar","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=ar","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=ar"},{"language":"de","title":"Codex Security ist open source, aber Maintainer sollten genau hinsehen","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=de","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=de","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=de","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=de"},{"language":"en","title":"Codex Security is open source, but maintainers should read the small print","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=en","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=en","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=en","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=en"},{"language":"es","title":"Codex Security es open source, pero los maintainers deben leer la letra pequeña","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=es","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=es","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=es","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=es"},{"language":"fr","title":"Codex Security est open source, mais les maintainers doivent lire les détails","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=fr","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=fr","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=fr","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=fr"},{"language":"pl","title":"Codex Security jest open source, ale maintainerzy powinni czytać drobny druk","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=pl","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=pl","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=pl","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=pl"},{"language":"ru","title":"Codex Security стал open source, но maintainers стоит читать мелкий шрифт","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=ru","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=ru","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=ru","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=ru"},{"language":"zh","title":"Codex Security 开源了，但 maintainers 需要看清细节","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=zh","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=zh","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=zh","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=zh"}],"_links":{"self":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=de","api":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=de","html":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=de","canonical":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=de","markdown":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=de","json":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=de","channel":"https://publicasta.com/api/public/v1/channels/open_source_radar","channel_articles":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles","search":"https://publicasta.com/api/public/v1/search","documentation":"https://publicasta.com/api-docs#reading-publicasta","openapi":"https://publicasta.com/api-docs/openapi.json","llms":"https://publicasta.com/llms.txt"}}