Hey,
We're approved for Daybreak Blue, but it looks like codex-security inherits the issue I reported in openai/codex#47834.
The project pins the standard Codex 0.156.1 release, which filters out the cyber access program unless authentication is through ChatGPT:
program
.filter(|_| auth.is_some_and(CodexAuth::is_chatgpt_auth))
.map(AccessPrograms::from)So even if we provide a selection, access_programs.cyber gets dropped when using an API key.
Can we get a supported way to pass this through from codex-security, including to scan workers? The API should validate whether the key is authorized and return an error if it isn't, rather than the harness silently removing the argument.
If this needs the upstream fix first, can we track updating the pinned Codex version here? We'd like to use the normal installation without maintaining a custom Codex binary.
Hey,
We're approved for Daybreak Blue, but it looks like
codex-securityinherits the issue I reported in openai/codex#47834.The project pins the standard Codex
0.156.1release, which filters out the cyber access program unless authentication is through ChatGPT:program .filter(|_| auth.is_some_and(CodexAuth::is_chatgpt_auth)) .map(AccessPrograms::from)So even if we provide a selection,
access_programs.cybergets dropped when using an API key.Can we get a supported way to pass this through from
codex-security, including to scan workers? The API should validate whether the key is authorized and return an error if it isn't, rather than the harness silently removing the argument.If this needs the upstream fix first, can we track updating the pinned Codex version here? We'd like to use the normal installation without maintaining a custom Codex binary.