{"schema_version":"1.0","service":"Publicasta","type":"article","id":224,"slug":"openai_codex_security_open_source_scanner_2026_07_29","title":"Codex Security es open source, pero los maintainers deben leer la letra pequeña","excerpt":"El nuevo CLI de seguridad de OpenAI puede ayudar en OSS, pero el primer día dejó lecciones sobre acceso, coste y package naming.","language":"es","default_language":"en","canonical_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=es","image":{"url":"https://publicasta.com/storage/projects/10/pages/224/2026/07/8de00274-dc50-4a59-84d5-eaea0d1a44f2.webp","alt":"Scanner de seguridad open source revisando un repository diff y un reporte SARIF"},"publisher":{"id":10,"slug":"open_source_radar","name":"Open Source Radar","url":"https://publicasta.com/open_source_radar"},"author":{"name":"Anton R"},"published_at":"2026-07-29T13:41:16+00:00","updated_at":"2026-07-29T13:41:16+00:00","content_markdown":"Codex Security de OpenAI importa menos por la frase “AI scans code” que por el experimento público: un flujo de seguridad para maintainers, publicado bajo Apache-2.0, recibió una prueba inmediata de la comunidad open source.\n\n ![Scanner de seguridad open source revisando un repository diff y un reporte SARIF](https://publicasta.com/storage/projects/10/pages/224/2026/07/8de00274-dc50-4a59-84d5-eaea0d1a44f2.webp)\n\n Al revisarlo, `openai/codex-security` tenía 3,985 stars, 221 forks, 48 open issues y la descripción “SDKs and CLI for Codex Security”. En Hacker News, el hilo “Codex Security” llegó a 544 points y 196 comments. No fue una reacción superficial; la discusión se centró en coste, acceso, guardrails, resultados parciales y fricción real del CLI.\n\n La herramienta es un CLI y TypeScript SDK para encontrar, validar y corregir vulnerabilities. La documentación habla de repository scans, path scans, diff scans, working-tree scans, deep mode, knowledge-base context, pre-commit hook, bulk scans, SARIF export y scan history. Los resultados incluyen `scan-manifest.json`, `findings.json`, `coverage.json`, `report.md`, `artifacts/` y `exports/results.sarif`.\n\n La forma es buena. Un maintainer no necesita más ruido; necesita findings revisables, cobertura clara y artefactos que funcionen con CI. Pero esto no es un scanner local y autónomo como CodeQL, Semgrep, Trivy, Gitleaks u osv-scanner. Es un cliente open source alrededor de un servicio de OpenAI. Requiere Node.js 22+, Python 3.10+ para scans/export, login de ChatGPT o `OPENAI_API_KEY`, y algunos scans pueden requerir Trusted Access for Cyber.\n\n El primer día dejó señales útiles. Usuarios de HN hablaron de scans largos, consumo de uso, partial output y refusals por cyber guardrails. GitHub issue #66 reportó un fallo en Windows 11 al guardar `scan-manifest.json`; PR #67 propuso un arreglo. Issue #68 fue el caso más irónico: ejemplos de README usaban `npx codex-security`, aunque el paquete oficial es `@openai/codex-security`. El nombre sin scope existía en npm como placeholder no afiliado.\n\n Veredicto: merece probarse, pero no a ciegas. Empieza con un repo propio pequeño, usa `--dry-run`, escribe resultados fuera del repo, limita coste con `--max-cost`, revisa `coverage.json` y compara findings con scanners conocidos. Codex Security puede ayudar en review contextual, pero todavía es un asistente experimental, no un sustituto de AppSec ni de la revisión humana.","available_translations":[{"language":"ar","title":"أصبح Codex Security مفتوح المصدر، لكن على maintainers قراءة التفاصيل","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=ar","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=ar","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=ar","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=ar"},{"language":"de","title":"Codex Security ist open source, aber Maintainer sollten genau hinsehen","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=de","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=de","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=de","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=de"},{"language":"en","title":"Codex Security is open source, but maintainers should read the small print","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=en","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=en","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=en","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=en"},{"language":"es","title":"Codex Security es open source, pero los maintainers deben leer la letra pequeña","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=es","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=es","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=es","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=es"},{"language":"fr","title":"Codex Security est open source, mais les maintainers doivent lire les détails","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=fr","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=fr","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=fr","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=fr"},{"language":"pl","title":"Codex Security jest open source, ale maintainerzy powinni czytać drobny druk","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=pl","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=pl","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=pl","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=pl"},{"language":"ru","title":"Codex Security стал open source, но maintainers стоит читать мелкий шрифт","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=ru","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=ru","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=ru","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=ru"},{"language":"zh","title":"Codex Security 开源了，但 maintainers 需要看清细节","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=zh","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=zh","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=zh","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=zh"}],"_links":{"self":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=es","api":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=es","html":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=es","canonical":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=es","markdown":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=es","json":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=es","channel":"https://publicasta.com/api/public/v1/channels/open_source_radar","channel_articles":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles","search":"https://publicasta.com/api/public/v1/search","documentation":"https://publicasta.com/api-docs#reading-publicasta","openapi":"https://publicasta.com/api-docs/openapi.json","llms":"https://publicasta.com/llms.txt"}}