{"schema_version":"1.0","service":"Publicasta","type":"article","id":224,"slug":"openai_codex_security_open_source_scanner_2026_07_29","title":"Codex Security jest open source, ale maintainerzy powinni czytać drobny druk","excerpt":"Nowy security CLI OpenAI może pomóc OSS, ale pierwszy dzień pokazał problemy z dostępem, kosztem i package naming.","language":"pl","default_language":"en","canonical_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=pl","image":{"url":"https://publicasta.com/storage/projects/10/pages/224/2026/07/8de00274-dc50-4a59-84d5-eaea0d1a44f2.webp","alt":"Open-source security scanner sprawdza repository diff i raport SARIF"},"publisher":{"id":10,"slug":"open_source_radar","name":"Open Source Radar","url":"https://publicasta.com/open_source_radar"},"author":{"name":"Anton R"},"published_at":"2026-07-29T13:41:18+00:00","updated_at":"2026-07-29T13:41:18+00:00","content_markdown":"Codex Security od OpenAI jest ciekawy nie dlatego, że kolejne AI czyta kod. Ciekawsze jest to, że workflow bezpieczeństwa dla maintainerów trafił do repozytorium Apache-2.0 i od razu został sprawdzony przez społeczność open source.\n\n ![Open-source security scanner sprawdza repository diff i raport SARIF](https://publicasta.com/storage/projects/10/pages/224/2026/07/8de00274-dc50-4a59-84d5-eaea0d1a44f2.webp)\n\n W chwili sprawdzania `openai/codex-security` miał 3,985 stars, 221 forks, 48 open issues i opis “SDKs and CLI for Codex Security”. Wątek “Codex Security” na Hacker News miał 544 points i 196 comments. Dyskusja szybko zeszła na koszt, dostęp, guardrails, długie skany i problemy CLI.\n\n Narzędzie to CLI i TypeScript SDK do znajdowania, walidowania i naprawiania vulnerabilities. Dokumentacja opisuje repository scans, path scans, diff scans, working-tree scans, deep mode, knowledge-base context, pre-commit hook, bulk scans, SARIF export i scan history. Wyniki obejmują między innymi `scan-manifest.json`, `findings.json`, `coverage.json`, `report.md`, `artifacts/` i `exports/results.sarif`.\n\n Kierunek jest sensowny. Maintainerzy nie potrzebują kolejnych ogólnych warningów; potrzebują sprawdzalnych findings, jasnego coverage i artefaktów pasujących do CI. Ale Codex Security nie jest samodzielnym lokalnym scannerem jak CodeQL, Semgrep, Trivy, Gitleaks czy osv-scanner. To open-source client wokół usługi OpenAI. Wymaga Node.js 22+, Python 3.10+ dla scans/export, ChatGPT login albo `OPENAI_API_KEY`; pełne skany repo mogą wymagać Trusted Access for Cyber.\n\n Pierwszy dzień pokazał tarcie. Użytkownicy HN pisali o długich skanach, zużyciu limitów, partial output i odmowach przez cyber guardrails. GitHub issue #66 zgłosił błąd Windows 11 przy zapisie `scan-manifest.json`; PR #67 proponował poprawkę. Issue #68 było szczególnie wymowne: README używało `npx codex-security`, choć oficjalny pakiet to `@openai/codex-security`. Nazwa bez scope istniała w npm jako niepowiązany placeholder.\n\n Werdykt: warto przetestować, ale ostrożnie. Zacznij od własnego małego repo, użyj `--dry-run`, zapisuj wyniki poza repo, ustaw `--max-cost`, przeczytaj `coverage.json` i porównaj findings ze znanymi scannerami. Codex Security może pomóc w review kontekstowym, ale na razie jest eksperymentalnym asystentem, nie zamiennikiem AppSec.","available_translations":[{"language":"ar","title":"أصبح Codex Security مفتوح المصدر، لكن على maintainers قراءة التفاصيل","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=ar","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=ar","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=ar","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=ar"},{"language":"de","title":"Codex Security ist open source, aber Maintainer sollten genau hinsehen","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=de","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=de","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=de","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=de"},{"language":"en","title":"Codex Security is open source, but maintainers should read the small print","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=en","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=en","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=en","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=en"},{"language":"es","title":"Codex Security es open source, pero los maintainers deben leer la letra pequeña","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=es","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=es","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=es","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=es"},{"language":"fr","title":"Codex Security est open source, mais les maintainers doivent lire les détails","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=fr","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=fr","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=fr","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=fr"},{"language":"pl","title":"Codex Security jest open source, ale maintainerzy powinni czytać drobny druk","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=pl","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=pl","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=pl","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=pl"},{"language":"ru","title":"Codex Security стал open source, но maintainers стоит читать мелкий шрифт","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=ru","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=ru","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=ru","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=ru"},{"language":"zh","title":"Codex Security 开源了，但 maintainers 需要看清细节","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=zh","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=zh","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=zh","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=zh"}],"_links":{"self":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=pl","api":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=pl","html":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=pl","canonical":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=pl","markdown":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=pl","json":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=pl","channel":"https://publicasta.com/api/public/v1/channels/open_source_radar","channel_articles":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles","search":"https://publicasta.com/api/public/v1/search","documentation":"https://publicasta.com/api-docs#reading-publicasta","openapi":"https://publicasta.com/api-docs/openapi.json","llms":"https://publicasta.com/llms.txt"}}