{"schema_version":"1.0","service":"Publicasta","type":"article","id":224,"slug":"openai_codex_security_open_source_scanner_2026_07_29","title":"Codex Security 开源了，但 maintainers 需要看清细节","excerpt":"OpenAI 的新安全 CLI 对 OSS review 有吸引力，但第一天就暴露了访问、成本、guardrails 和包名问题。","language":"zh","default_language":"en","canonical_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=zh","image":{"url":"https://publicasta.com/storage/projects/10/pages/224/2026/07/8de00274-dc50-4a59-84d5-eaea0d1a44f2.webp","alt":"Open source 安全 scanner 正在检查 repository diff 和 SARIF report"},"publisher":{"id":10,"slug":"open_source_radar","name":"Open Source Radar","url":"https://publicasta.com/open_source_radar"},"author":{"name":"Anton R"},"published_at":"2026-07-29T13:41:19+00:00","updated_at":"2026-07-29T13:41:19+00:00","content_markdown":"OpenAI 的 Codex Security 值得关注，不只是因为又有一个 AI 工具会看代码。更有意思的是，它把面向 maintainer 的安全工作流放进 Apache-2.0 GitHub 仓库，然后立刻被 open source 社区公开检验。\n\n ![Open source 安全 scanner 正在检查 repository diff 和 SARIF report](https://publicasta.com/storage/projects/10/pages/224/2026/07/8de00274-dc50-4a59-84d5-eaea0d1a44f2.webp)\n\n 检查时，`openai/codex-security` 有 3,985 stars、221 forks、48 open issues，描述为 “SDKs and CLI for Codex Security”。Hacker News 上的 “Codex Security” 讨论有 544 points 和 196 comments。讨论重点很快从发布本身转向访问、成本、guardrails、长时间扫描和 CLI 问题。\n\n 这个工具是 CLI 加 TypeScript SDK，用来发现、验证和修复 vulnerabilities。文档提到 repository scans、path scans、diff scans、working-tree scans、deep mode、knowledge-base context、pre-commit hook、bulk scans、SARIF export 和 scan history。输出包括 `scan-manifest.json`、`findings.json`、`coverage.json`、`report.md`、`artifacts/`，以及可能生成的 `exports/results.sarif`。\n\n 方向是对的。Maintainers 不缺泛泛的 warning；他们需要可复查的 findings、清楚的 coverage 和能接入 CI 的 artifacts。但 Codex Security 不是 CodeQL、Semgrep、Trivy、Gitleaks 或 osv-scanner 那样的完全本地 scanner。它是围绕 OpenAI 服务的 open-source client。文档要求 Node.js 22+，scans/export 还需要 Python 3.10+；本地使用 ChatGPT login，CI 使用 `OPENAI_API_KEY`，部分 full-repository scans 可能需要 Trusted Access for Cyber。\n\n 第一天的问题也很有价值。HN 用户提到扫描时间长、usage 消耗、partial output，以及因为 cyber guardrails 出现 refusals。GitHub issue #66 报告了 Windows 11 上保存 `scan-manifest.json` 的错误；PR #67 提出修复。Issue #68 更像安全课本案例：README 示例用了 `npx codex-security`，但官方包名是 `@openai/codex-security`。没有 scope 的名字在 npm 上确实存在，是一个非官方 placeholder。\n\n 结论：可以试，但要控制范围。先用自己拥有的小 repo，运行 `--dry-run`，把结果写到 repo 外，设置 `--max-cost`，阅读 `coverage.json`，并和已有 scanner 对比。Codex Security 可能适合上下文安全 review，但现在仍是实验性助手，不是 AppSec 或人工审查的替代品。","available_translations":[{"language":"ar","title":"أصبح Codex Security مفتوح المصدر، لكن على maintainers قراءة التفاصيل","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=ar","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=ar","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=ar","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=ar"},{"language":"de","title":"Codex Security ist open source, aber Maintainer sollten genau hinsehen","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=de","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=de","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=de","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=de"},{"language":"en","title":"Codex Security is open source, but maintainers should read the small print","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=en","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=en","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=en","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=en"},{"language":"es","title":"Codex Security es open source, pero los maintainers deben leer la letra pequeña","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=es","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=es","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=es","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=es"},{"language":"fr","title":"Codex Security est open source, mais les maintainers doivent lire les détails","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=fr","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=fr","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=fr","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=fr"},{"language":"pl","title":"Codex Security jest open source, ale maintainerzy powinni czytać drobny druk","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=pl","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=pl","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=pl","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=pl"},{"language":"ru","title":"Codex Security стал open source, но maintainers стоит читать мелкий шрифт","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=ru","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=ru","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=ru","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=ru"},{"language":"zh","title":"Codex Security 开源了，但 maintainers 需要看清细节","html_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=zh","markdown_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=zh","json_url":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=zh","api_url":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=zh"}],"_links":{"self":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=zh","api":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles/openai_codex_security_open_source_scanner_2026_07_29?lang=zh","html":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=zh","canonical":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29?lang=zh","markdown":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.md?lang=zh","json":"https://publicasta.com/open_source_radar/openai_codex_security_open_source_scanner_2026_07_29.json?lang=zh","channel":"https://publicasta.com/api/public/v1/channels/open_source_radar","channel_articles":"https://publicasta.com/api/public/v1/channels/open_source_radar/articles","search":"https://publicasta.com/api/public/v1/search","documentation":"https://publicasta.com/api-docs#reading-publicasta","openapi":"https://publicasta.com/api-docs/openapi.json","llms":"https://publicasta.com/llms.txt"}}