Home / openai / codex-security
AI Slop Code RIsk Monitor

openai/codex-security

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security

5.4 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for openai/codex-security, a TypeScript project with 11,058 GitHub stars. SynthScan examined 337,278 lines of code across 778 source files, recording 1888 pattern matches distributed across 14 syntactic categories. The legacy adjusted pattern signal is 5.4 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

5.4
Adjusted Signal
5.4
Raw Pattern Score
100%
Time Factor
2026-10-11
Last Push
11.1K
Stars
TypeScript
Language
337.3K
Lines of Code
778
Files
1.9K
Pattern Hits
2026-10-12
Scan Date
0.08
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 19.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1730 finding(s).

Hallucinated Dependency & Supply Chain Risk 3.8/100 · LOW

Are imports declared and package/API names verified? 131 finding(s).

Agent Over-Engineering Ratio 19.7/100 · LOW

Are wrappers, guards, and repeated structures necessary? 1680 finding(s).

PR Review Velocity Impact 27.7/100 · MEDIUM

Which changes need focused human review? 1888 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 58MEDIUM 2LOW 1827

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1888 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers1650 hits · 1370 pts
SeverityFileLineSnippetContext
LOWplugins/codex-security/mcp-app/artifact-writer-main.ts14export async function createCodexSecurityArtifactWriterServer(CODE
LOWplugins/codex-security/mcp-app/server.ts525export function createCodexSecurityServer(): McpServer {CODE
LOWplugins/codex-security/mcp-app/server.ts1902async function startHeadlessStandardScan(CODE
LOWplugins/codex-security/mcp-app/server.ts2020function buildUserInputElicitation(CODE
LOWplugins/codex-security/mcp-app/server.ts2339function codexModelSettingsFromExtra(extra: unknown): {CODE
LOWplugins/codex-security/mcp-app/server.ts2391function deepScanInvocationFailureMessage(error: unknown): string {CODE
LOW…rity/mcp-app/tests/test_deep_scan_store_integration.ts47async function testCoordinatorCommitResponseRecovery(CODE
LOW…rity/mcp-app/tests/test_deep_scan_store_integration.ts217async function testFreeformFailureMessagesAgainstRealWorkbench() {CODE
LOW…rity/mcp-app/tests/test_deep_scan_store_integration.ts250async function testRecoveredPublicationRejectsLateFailure() {CODE
LOW…rity/mcp-app/tests/test_deep_scan_store_integration.ts314async function testNoopStoppedRefreshRetainsPublicationFailure() {CODE
LOW…rity/mcp-app/tests/test_deep_scan_store_integration.ts375async function testConcurrentParentDraftsPreserveBothCheckpoints() {CODE
LOW…rity/mcp-app/tests/test_deep_scan_store_integration.ts441async function testLateParentDraftPreservesCheckpointWithoutOverwritingTerminalSeal() {CODE
LOW…rity/mcp-app/tests/test_deep_scan_store_integration.ts509async function testReducerCommitAndFinishAgainstRealWorkbench(CODE
LOW…rity/mcp-app/tests/test_deep_scan_store_integration.ts787async function testExpiredDeadlineWithoutCompletedDiscoveryAgainstRealWorkbench() {CODE
LOW…ex-security/mcp-app/tests/deep_scan_lifecycle_cases.ts54 async function canceledPublicationWaitsForHeartbeat() {CODE
LOW…ex-security/mcp-app/tests/deep_scan_lifecycle_cases.ts87 async function delayedReducerDoesNotReplaceStoppedState() {CODE
LOW…ex-security/mcp-app/tests/deep_scan_lifecycle_cases.ts119 async function replacementWaitsForTerminalResult() {CODE
LOW…ex-security/mcp-app/tests/deep_scan_lifecycle_cases.ts156 async function concurrentOwnershipReadsKeepReplacementResult() {CODE
LOW…ex-security/mcp-app/tests/deep_scan_lifecycle_cases.ts248 async function lateFailurePersistenceKeepsStoppedState() {CODE
LOW…ex-security/mcp-app/tests/deep_scan_lifecycle_cases.ts313 async function shutdownStopsReplacementObservation() {CODE
LOW…ex-security/mcp-app/tests/deep_scan_lifecycle_cases.ts340 async function failedCancellationStillPreservesResults() {CODE
LOW…ex-security/mcp-app/tests/deep_scan_lifecycle_cases.ts390 async function lateCancellationKeepsPersistedFailure() {CODE
LOW…ex-security/mcp-app/tests/deep_scan_lifecycle_cases.ts425 async function terminalDiscoveryWaitsForCleanup() {CODE
LOW…ex-security/mcp-app/tests/deep_scan_lifecycle_cases.ts487 async function orphanWorkerDirectoriesAreNotReused() {CODE
LOW…ex-security/mcp-app/tests/deep_scan_lifecycle_cases.ts530 async function ancestorNamesDoNotChooseWorkerSequence() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts34async function testBeginProtocolAndParsing() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts99async function testWriteSerializationAndRecovery() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts149async function testBeginUsesTheWriteQueue() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts179async function testHeartbeatBypassesBlockedWriteQueue() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts233async function testOwnershipReadClearsStaleLease() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts302async function testWorkerResponseParsing() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts343async function testReplaceableDiscoveryFailureProtocol() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts388async function testCanonicalCommitProtocol() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts452async function testTransientIdempotentPersistenceRetries() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts489async function testTransientTimeoutAndNestedCauseRetries() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts527async function testPersistenceRetriesRemainInsideTheWriteQueue() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts555async function testPersistenceRetryExhaustionPreservesDiagnostics() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts642async function testDeterministicPersistenceFailuresAreNotRetried() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts727async function testNonIdempotentMutationsAreNotRetried() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts756function idempotentPersistenceScenarios() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts858function testInvalidPersistedConfig() {CODE
LOW…s/codex-security/mcp-app/tests/test_deep_scan_store.ts909function testConfiguredMaximumDurationParsing() {CODE
LOW…security/mcp-app/tests/test_compact_artifact_server.ts100async function testCompactDiffScanCompletion(CODE
LOW…security/mcp-app/tests/test_compact_artifact_server.ts328async function testSemanticScanDraftCompletion(CODE
LOW…security/mcp-app/tests/test_compact_artifact_server.ts865async function testClaimedParentArtifactOperations(CODE
LOW…security/mcp-app/tests/test_compact_artifact_server.ts1306async function testDiscoveryWorkerToolList(bundle: string) {CODE
LOW…security/mcp-app/tests/test_compact_artifact_server.ts1417async function testReducerWorkerToolList(bundle: string) {CODE
LOW…odex-security/mcp-app/tests/test_artifact_discovery.ts234async function verifyNormalizationAndPagination(context: ArtifactContext) {CODE
LOW…odex-security/mcp-app/tests/test_artifact_discovery.ts320async function verifyNormalizerFailuresPreserveOutput(CODE
LOW…odex-security/mcp-app/tests/test_artifact_discovery.ts424async function verifyNormalizationRunsOffThread(context: ArtifactContext) {CODE
LOW…odex-security/mcp-app/tests/test_artifact_discovery.ts467async function verifyDiffInventoryAllowsDeletedFiles() {CODE
LOW…odex-security/mcp-app/tests/test_artifact_discovery.ts709async function verifyReaderPreservesSharedPhaseRecords(CODE
LOW…odex-security/mcp-app/tests/test_artifact_discovery.ts774async function verifyMalformedLedgerIsNotModified() {CODE
LOWplugins/codex-security/mcp-app/tests/sandbox-state.ts3export function readOnlyParentSandboxState(pluginRoot: string) {CODE
LOW…-security/mcp-app/tests/scan-draft-recovery-fixture.ts30export async function recordCodexSecurityScanDraft(CODE
LOW…ecurity/mcp-app/tests/deep_scan_coordinator_fixture.ts727export async function assertNoPublishedCandidates(scanDir: string) {CODE
LOW…dex-security/mcp-app/tests/test_artifact_scan_draft.ts3017async function archiveFirstWorkerAttempt(output: string) {CODE
LOW…p/tests/test_deep_scan_permission_profile_preflight.ts162async function testAllowedProfileAndRawArgv() {CODE
LOW…p/tests/test_deep_scan_permission_profile_preflight.ts231async function testProvidedEnvForwardedWithoutMutation() {CODE
LOW…p/tests/test_deep_scan_permission_profile_preflight.ts254async function testOpenAiApiKeyFallbackPreservesNativeAuthentication() {CODE
1590 more matches not shown…
Cross-Language Confusion (JS/TS)35 hits · 160 pts
SeverityFileLineSnippetContext
HIGH…rity/mcp-app/tests/test_deep_scan_store_integration.ts575print("locked", flush=True)CODE
HIGH…ity/mcp-app/tests/test_artifact_scan_draft_recovery.ts191print(json.dumps([first[2],replay[2]]))`,CODE
HIGH…s/codex-security/mcp-app/src/helpers/rank-worklists.ts196 print(CODE
HIGH…odex-security/mcp-app/src/helpers/deep-review-input.ts29 print(CODE
HIGH…odex-security/mcp-app/src/helpers/deep-review-input.ts60 print(message);CODE
HIGH…codex-security/mcp-app/src/helpers/bind-repo-scopes.ts23 print(CODE
HIGH…codex-security/mcp-app/src/helpers/bind-repo-scopes.ts67 print(`Bound ${scopes.length} requested scopes into the scan contract`);CODE
HIGH…gins/codex-security/mcp-app/src/helpers/rank-shards.ts158 print(`Wrote ${count} rank shards to ${directory}`);CODE
HIGH…gins/codex-security/mcp-app/src/helpers/rank-shards.ts211 print(`Merged ${merged.length} ranking rows into ${output}`);CODE
HIGH…gins/codex-security/mcp-app/src/helpers/rank-shards.ts236 print(CODE
HIGH…gins/codex-security/mcp-app/src/helpers/rank-shards.ts253 print(`Validated ${rows.length} ranking rows in ${output}`);CODE
HIGHplugins/codex-security/mcp-app/src/helpers/rank-pool.ts77 print(CODE
HIGHplugins/codex-security/mcp-app/src/helpers/rank-pool.ts239 print(CODE
HIGHplugins/codex-security/mcp-app/src/helpers/rank-pool.ts271 print(CODE
HIGHplugins/codex-security/mcp-app/src/helpers/rank-pool.ts306 print(CODE
HIGHsdk/typescript/tests-ts/publication-store.test.ts588print(json.dumps({table: connection.execute("SELECT COUNT(*) FROM " + table).fetchone()[0] for table in ("scans", "findiSTRING
HIGHsdk/typescript/tests-ts/repository-findings.test.ts61print(json.dumps(result))STRING
HIGHsdk/typescript/tests-ts/findings-store.test.ts189print("null")`,CODE
HIGHsdk/typescript/tests-ts/findings-store.test.ts246print("null")`,CODE
HIGHsdk/typescript/tests-ts/findings-store.test.ts266print(db.execute("SELECT COUNT(*) FROM finding_embeddings").fetchone()[0])`;CODE
HIGH…/typescript/tests-ts/workbench-canonical-paths.test.ts37 " return True",CODE
HIGH…/typescript/tests-ts/workbench-canonical-paths.test.ts77 " return False",CODE
HIGH…/typescript/tests-ts/workbench-canonical-paths.test.ts78 " return True",CODE
HIGH…pescript/tests-ts/finding-workflow-integration.test.ts966print(json.dumps([dict(row) for row in db.execute("SELECT * FROM finding_workflow_reviews ORDER BY review_key")]))`,CODE
HIGHsdk/typescript/tests-ts/workbench-scan-history.test.ts120print(json.dumps(comparison['matchingInputs']))STRING
HIGHsdk/typescript/tests-ts/workbench-scan-history.test.ts198print(json.dumps({'summary': accepted['summary'],STRING
HIGHsdk/typescript/tests-ts/workbench-scan-history.test.ts266print(json.dumps({'unchanged': rows() == original, 'comparisons': len(original),CODE
HIGHsdk/typescript/tests-ts/workbench-scan-history.test.ts489print(json.dumps({'uncertain': uncertain, 'excluded': excluded, 'resolved': resolved,CODE
HIGHsdk/typescript/tests-ts/workbench-scan-history.test.ts612print(json.dumps({STRING
HIGHsdk/typescript/tests-ts/workbench-scan-history.test.ts676print(json.dumps({'withLinks': with_links, 'withoutLinks': collect_history()}))STRING
HIGHsdk/typescript/tests-ts/contract.test.ts820 " return False",CODE
HIGHsdk/typescript/tests-ts/contract.test.ts821 " return True",CODE
HIGH…cript/tests-ts/workbench-windows-compatibility.test.ts34 " def is_dir(self): return True",CODE
HIGHsdk/typescript/src/runtime.ts126print(json.dumps({CODE
HIGHsdk/typescript/src/runtime.ts1611print(json.dumps(result, allow_nan=False, sort_keys=True))CODE
Unused Imports93 hits · 85 pts
SeverityFileLineSnippetContext
LOW…odex-security/tests/test_deep_scan_request_identity.py1CODE
LOW…s/codex-security/tests/test_saved_deferred_identity.py1CODE
LOW…odex-security/tests/test_workbench_checkpoint_heads.py1CODE
LOWplugins/codex-security/tests/test_workbench_archive.py1CODE
LOWplugins/codex-security/tests/test_plugin_contract.py1CODE
LOWplugins/codex-security/tests/conftest.py1CODE
LOW…/codex-security/tests/test_validate_tracking_source.py1CODE
LOWplugins/codex-security/tests/test_workbench_db.py1CODE
LOWplugins/codex-security/tests/test_workbench_target.py1CODE
LOW…ns/codex-security/tests/test_finalize_scan_contract.py1CODE
LOW…urity/tests/test_workbench_remediation_cancellation.py1CODE
LOW…s/codex-security/tests/test_portable_artifact_paths.py1CODE
LOW…odex-security/tests/test_workbench_prompt_only_scan.py1CODE
LOW…/codex-security/tests/test_workbench_native_indexes.py1CODE
LOW…ns/codex-security/tests/test_workbench_cancellation.py1CODE
LOW…-security/tests/test_workbench_setup_and_migrations.py1CODE
LOW…gins/codex-security/tests/test_workbench_db_exports.py1CODE
LOW…security/tests/test_workbench_standard_deep_results.py1CODE
LOW…ins/codex-security/tests/test_windows_scope_streams.py1CODE
LOW…/codex-security/tests/test_finalize_scan_timestamps.py1CODE
LOW…dex-security/tests/test_workbench_draft_publication.py1CODE
LOW…/codex-security/tests/test_windows_scan_local_files.py1CODE
LOW…ex-security/tests/test_workbench_output_permissions.py1CODE
LOW…gins/codex-security/tests/test_workbench_scan_usage.py1CODE
LOW…ecurity/tests/test_deep_scan_successful_publication.py1CODE
LOWplugins/codex-security/tests/test_report_projection.py1CODE
LOWplugins/codex-security/tests/test_rank_preview.py1CODE
LOW…ex-security/tests/test_workbench_completion_binding.py1CODE
LOW…codex-security/tests/test_git_inventory_regressions.py1CODE
LOW…ns/codex-security/tests/test_workbench_scan_archive.py1CODE
LOW…gins/codex-security/tests/test_track_findings_skill.py1CODE
LOW…codex-security/tests/test_deep_scan_stop_conditions.py1CODE
LOW…ugins/codex-security/tests/test_capability_profiles.py1CODE
LOWplugins/codex-security/tests/workbench_test_support.py1CODE
LOW…ity/tests/test_deep_security_scan_concurrency_guard.py1CODE
LOWplugins/codex-security/tests/test_sarif_projection.py1CODE
LOWplugins/codex-security/tests/test_workbench_feedback.py1CODE
LOWplugins/codex-security/tests/source_cases.py8CODE
LOW…s/codex-security/tests/test_threat_model_projection.py1CODE
LOWplugins/codex-security/tests/test_runtime_settings.py1CODE
LOW…-security/tests/test_resolved_deferred_finalization.py1CODE
LOW…ugins/codex-security/tests/test_workbench_deep_scan.py1CODE
LOW…ns/codex-security/tests/test_saved_deferred_unicode.py1CODE
LOW…ns/codex-security/tests/test_workbench_local_dedupe.py1CODE
LOW…ins/codex-security/tests/test_deep_scan_publication.py1CODE
LOW…ns/codex-security/tests/test_workbench_scan_history.py1CODE
LOWplugins/codex-security/tests/test_finding_preview.py1CODE
LOWplugins/codex-security/tests/test_windows_report_e2e.py1CODE
LOW…dex-security/tests/test_workbench_remediation_retry.py1CODE
LOWplugins/codex-security/tests/test_cli_dry_runs.py1CODE
LOW…ex-security/tests/test_workbench_saved_source_order.py1CODE
LOW…ns/codex-security/tests/test_scan_contract_examples.py1CODE
LOW…ns/codex-security/tests/test_validate_scan_contract.py1CODE
LOW…dex-security/tests/test_workbench_finding_workflows.py1CODE
LOW…-security/tests/test_workbench_native_index_queries.py1CODE
LOW…s/codex-security/tests/test_generate_in_scope_files.py1CODE
LOW…ugins/codex-security/tests/test_generate_rank_input.py1CODE
LOWplugins/codex-security/tests/test_workbench_handoff.py1CODE
LOW…gins/codex-security/tests/test_workbench_timestamps.py1CODE
LOWplugins/codex-security/scripts/workbench_feedback.py3CODE
33 more matches not shown…
Empty Error Handlers16 hits · 80 pts
SeverityFileLineSnippetContext
HIGH…-security/tests/test_workbench_setup_and_migrations.py401except RuntimeError:CODE
HIGHplugins/codex-security/scripts/workbench_scan_start.py208except FileNotFoundError:CODE
HIGHplugins/codex-security/scripts/deep_scan_workbench.py859except (OSError, KeyError, TypeError, ValueError):CODE
HIGH…ins/codex-security/scripts/windows_scan_local_files.py709except OSError:CODE
HIGH…ugins/codex-security/scripts/finalize_scan_contract.py773except FileNotFoundError:CODE
HIGH…ugins/codex-security/scripts/finalize_scan_contract.py238except (ContractError, OSError):CODE
HIGH…ugins/codex-security/scripts/finalize_scan_contract.py826except FileNotFoundError:CODE
HIGH…ugins/codex-security/scripts/finalize_scan_contract.py1938except ContractError:CODE
HIGH…ugins/codex-security/scripts/finalize_scan_contract.py548except FileExistsError:CODE
HIGH…ugins/codex-security/scripts/finalize_scan_contract.py1919except ContractError:CODE
HIGH…ugins/codex-security/scripts/finalize_scan_contract.py805except OSError:CODE
HIGH…gins/codex-security/scripts/workbench_saved_results.py82except (ContractError, OSError, SystemExit):CODE
HIGH…gins/codex-security/scripts/workbench_saved_results.py878except FileNotFoundError:CODE
HIGH…gins/codex-security/scripts/workbench_saved_results.py427except (ContractError, OSError, ValueError):CODE
HIGHplugins/codex-security/scripts/workbench_db.py703except SystemExit:CODE
HIGHplugins/codex-security/scripts/workbench_db.py2622except SystemExit:CODE
Deep Nesting74 hits · 56 pts
SeverityFileLineSnippetContext
LOW…odex-security/tests/test_workbench_checkpoint_heads.py806CODE
LOWplugins/codex-security/tests/test_workbench_target.py121CODE
LOW…ns/codex-security/tests/test_finalize_scan_contract.py758CODE
LOW…ns/codex-security/tests/test_finalize_scan_contract.py1392CODE
LOW…ns/codex-security/tests/test_finalize_scan_contract.py1939CODE
LOW…odex-security/tests/test_workbench_prompt_only_scan.py241CODE
LOW…odex-security/tests/test_workbench_prompt_only_scan.py301CODE
LOW…-security/tests/test_workbench_setup_and_migrations.py2391CODE
LOW…gins/codex-security/tests/test_workbench_db_exports.py555CODE
LOW…gins/codex-security/tests/test_workbench_db_exports.py1201CODE
LOW…ns/codex-security/tests/test_workbench_scan_archive.py197CODE
LOWplugins/codex-security/tests/workbench_test_support.py136CODE
LOW…s/codex-security/tests/test_threat_model_projection.py499CODE
LOW…s/codex-security/tests/test_threat_model_projection.py653CODE
LOW…ns/codex-security/tests/test_validate_scan_contract.py62CODE
LOWplugins/codex-security/scripts/finding_preview.py29CODE
LOWplugins/codex-security/scripts/finding_preview.py346CODE
LOWplugins/codex-security/scripts/workbench_scan_start.py90CODE
LOWplugins/codex-security/scripts/rank_preview.py27CODE
LOW…ugins/codex-security/scripts/workbench_local_dedupe.py23CODE
LOW…ugins/codex-security/scripts/workbench_scan_history.py59CODE
LOW…ugins/codex-security/scripts/workbench_scan_history.py503CODE
LOW…gins/codex-security/scripts/generate_in_scope_files.py88CODE
LOW…gins/codex-security/scripts/generate_in_scope_files.py160CODE
LOWplugins/codex-security/scripts/deep_scan_workbench.py301CODE
LOWplugins/codex-security/scripts/deep_scan_workbench.py687CODE
LOWplugins/codex-security/scripts/deep_scan_workbench.py886CODE
LOWplugins/codex-security/scripts/deep_scan_workbench.py1077CODE
LOW…ins/codex-security/scripts/windows_scan_local_files.py503CODE
LOW…ins/codex-security/scripts/windows_scan_local_files.py615CODE
LOW…ins/codex-security/scripts/windows_scan_local_files.py655CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py175CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py289CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py356CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py541CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py570CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py727CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py1019CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py1189CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py1850CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py2005CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py2322CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py2814CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py3096CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py357CODE
LOWplugins/codex-security/scripts/workbench_schema.py47CODE
LOWplugins/codex-security/scripts/workbench_schema.py101CODE
LOWplugins/codex-security/scripts/generate_rank_input.py104CODE
LOWplugins/codex-security/scripts/generate_rank_input.py224CODE
LOWplugins/codex-security/scripts/generate_rank_input.py272CODE
LOWplugins/codex-security/scripts/generate_rank_input.py362CODE
LOW…/codex-security/scripts/workbench_finding_workflows.py117CODE
LOWplugins/codex-security/scripts/config_preflight.py208CODE
LOWplugins/codex-security/scripts/config_preflight.py527CODE
LOW…gins/codex-security/scripts/threat_model_projection.py46CODE
LOWplugins/codex-security/scripts/workbench_scan_usage.py253CODE
LOWplugins/codex-security/scripts/workbench_scan_usage.py375CODE
LOWplugins/codex-security/scripts/workbench_scan_usage.py468CODE
LOWplugins/codex-security/scripts/workbench_target.py438CODE
LOWplugins/codex-security/scripts/workbench_target.py633CODE
14 more matches not shown…
Cross-File Repetition5 hits · 25 pts
SeverityFileLineSnippetContext
HIGHplugins/codex-security/tests/test_workbench_db.py0update deep_scan_runs set status = 'succeeded', phase = 'terminal', terminal_reason = 'saturated', completed_at = updateSTRING
HIGH…ex-security/tests/test_workbench_completion_binding.py0update deep_scan_runs set status = 'succeeded', phase = 'terminal', terminal_reason = 'saturated', completed_at = updateSTRING
HIGHplugins/codex-security/tests/workbench_test_support.py0update deep_scan_runs set status = 'succeeded', phase = 'terminal', terminal_reason = 'saturated', completed_at = updateSTRING
HIGH…ugins/codex-security/tests/test_workbench_deep_scan.py0update deep_scan_runs set status = 'succeeded', phase = 'terminal', terminal_reason = 'saturated', completed_at = updateSTRING
HIGHplugins/codex-security/scripts/deep_scan_workbench.py0update deep_scan_runs set status = 'succeeded', phase = 'terminal', terminal_reason = 'saturated', completed_at = updateSTRING
Hallucination Indicators1 hit · 10 pts
SeverityFileLineSnippetContext
CRITICAL…ins/codex-security/mcp-app/tests/test_mcp_app_smoke.ts3171 filteredFindingsPage.result.structuredContent.findingsPage.findings.map(CODE
Modern Structural Boilerplate6 hits · 6 pts
SeverityFileLineSnippetContext
LOW⚡plugins/codex-security/tests/test_workbench_target.py682def set_default_subprocess_encoding(monkeypatch: pytest.MonkeyPatch, encoding: str) -> None:STRING
LOWplugins/codex-security/tests/workbench_test_support.py129def update_digest_field(digest: Any, label: bytes, value: bytes) -> None:CODE
LOW…ugins/codex-security/scripts/finalize_scan_contract.py2231 def update_hash(current: int) -> None:CODE
LOW⚡plugins/codex-security/scripts/workbench_target.py375def _update_digest_field_header(digest: Any, label: bytes, value_size: int) -> None:CODE
LOW⚡plugins/codex-security/scripts/workbench_target.py381def update_digest_field(digest: Any, label: bytes, value: bytes) -> None:CODE
LOW…ugins/codex-security/scripts/workbench/runtime_toml.py5__all__ = ["tomllib"]CODE
Magic Placeholder Names1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHsdk/typescript/docs/cli.md42$env:OPENAI_API_KEY = "<your-api-key>"CODE
Cross-Language Confusion1 hit · 2 pts
SeverityFileLineSnippetContext
HIGHplugins/codex-security/scripts/workbench_scan_usage.py311 descendants.ancestry || edges.child_thread_id || '|',STRING
AI Structural Patterns3 hits · 2 pts
SeverityFileLineSnippetContext
LOWplugins/codex-security/tests/workbench_test_support.py745CODE
LOW…ugins/codex-security/tests/test_workbench_deep_scan.py127CODE
LOW…ns/codex-security/tests/test_workbench_scan_history.py186CODE
Slop Phrases1 hit · 2 pts
SeverityFileLineSnippetContext
MEDIUMsdk/typescript/tests-ts/codex-review.test.ts856 "I'm unable to assist with this comparison.",CODE
Self-Referential Comments1 hit · 2 pts
SeverityFileLineSnippetContext
MEDIUMsdk/typescript/src/project-config.ts195 "# This file is trusted like CLI options. Keep it outside untrusted inputs.",CODE
Over-Commented Block1 hit · 1 pts
SeverityFileLineSnippetContext
LOWsdk/typescript/src/scan-dashboard.ts121 readonly #options: ScanDashboardOptions;COMMENT