How does it fare against its own codebase?

This looks great, thanks for open-sourcing it!

How does it deal with the current guardrails 5.6 Sol has on finding vulnerabilities? When I use it in the Codex app it would sometimes say it found a vulnerability, but it cannot tell me what it is.

Been watching your progress for a while, glad OpenAI have looked after you and the team and you still get to ship!

They are entirely different products

Does it require hitting OpenAI's APIs or can one also stand up a local OpenAI compatible LLM endpoint?

> co-founder of Promptfoo and one of the people working on the Codex Security CLI at OpenAI.

> Thanks for checking this out and for flagging the auth issues.

Offtopic, but this right here is why I don't believe any marketing around "great amazing models that one-shot everything and programmers are no longer needed".

You just have to look at what these labs routinely produce, and their own products.

Edit to respond to @simonw whose comment I saw before he retracted it ;)

This comment is tied directly to consistent continuous claims by the LLM labs. Their own products disprove their own claims, and it would indeed be nice if fewer people believed them :)

When would I use this over the plugin in codex? Which I think can be invoked from cli as well

I tried it, it started a scan but stopped after hitting the rate-limit of my account. It gave up after just a minute of retrying (rate limits are tokens per minute, so... :P).

It said "Partial output was kept at <...>", but I dont see a obvious way of picking it up in a new scan? (The failed run cost me ~$13)

> Have experience shipping production full-stack products across modern web frontends and backend services.

I'm amazed that the requirements are so low (or at least this vague) for jobs at companies like these.

Has anyone else had the experience of going to an interview and feeling like you were never asked any qualifying questions?

All the questions were easy, your answers were straightforward, you "got them right", but then were not chosen?

I find on the other side, they're also left with dozens of people who "passed" and then it comes down to a pretty arbitrary decision on who gets hired (if we are talking external, no referral, etc.)

I wonder if they can make job descriptions highly specific to filter the shortlist faster and more effectively (to actually get a shortlist).

Anyway end rant. Cool job, hope you fill it.

Yes, I suspect companies that don’t allow ChatGPT will not be able to use the ChatGPT security analysis tool.

Yeah, this isn’t exactly new for us :d

Amazon bedrock is an option for gpt models that does not send your data to openai.

If you’re the one vibe coding you’re the arsonist.

comment feels like someone complaining about being offered a fireproofing solution in the age of flamethrowers.

Working as intended

I like to think it just upped the bar, but good durable expertise will need to rise with it.

Yeah, I think so too.

Oof, that's a bad outcome. Half your weekly usage and a 50-minute scan just to get a HEAD error at the end is not acceptable. --max-cost can help limit estimated spend, but that doesn't fix the underlying problem or give you your quota back. We need to handle a changing checkout and partial results much better. Sorry you ran into this. Please send me an email.

Yeah but management loved the idea.

oh yeah well I got my agent to analyze your write up and do a write up here:

https://pornoscan.us/codex-security-analysis.html

All of codex is a wrapper around their models. There’s still value in a purpose-built harness.

The plugin, including when invoked through the Codex CLI, is great for scanning the repo you're currently working in. The standalone Security CLI/SDK uses the same scanner, but is built for running security across many repos over time: org-wide scans, historical results, deduplication, false-positive tracking, budget controls, and CI integration.

We've been talking to hundreds of engineering and security teams, and their feedback is shaping what we build.

Like Promptfoo, our goal is practical tooling that fits into the workflows teams already have.

This sounds like it’s just an app development role, not a security analysis position, so I’m not sure what your complaint is.

yeah same here

Why would a few code snippets put Snyk out of business?

We are actively working on officially supporting this. Because it's open source it is pretty easy to point a coding agent at it now and switch out the model.

I plan to hack it to use openrouter and Kimi K3 or GLM 5.2 to keep expenses reasonable.

For context can you share the line count?

They are entirely different products

Does Amazon offer better privacy guarantees than OpenAI?

Exciting! Is there any open GitHub issue we can track?

I don't understand why Snyk is IN business in any way. Who really wants to upload his own code to a company that is specialized at searching security issues?

How can I trust that they show me all findings they have instead of selling the best ones to some three letter organisations?

yeah you mean because OAI is only whitebox? or expand on that a bit, haven't played around a ton w the oss codex sec

Yes, if only due to the business models being entirely different. AWS sells compute. OpenAI sells models. One of these things benefits from training on your data significantly more than the other.

FYI: Kimi K3 is relatively expensive on open router API pricing for agentic tasks, or at least that's been my experience playing around with it.

They just opened the weights. I expect competition from various providers will drop the price a bit. But you're right. I'd hope a model closer to GLM 5.2's price would be sufficiently useful.