Codex app security: sandbox on, secrets out, code checked

Abstract render of an app made of floating glass blocks inside a translucent orange shield dome

By the FixMyVibe team · Last reviewed 16 October 2026

Codex runs model-generated commands, so keep its sandbox and approval policy on, avoid full-access mode outside an isolated container, and keep Codex updated. Then check what it built: no private keys in the repository and database rules that only let each user reach their own data.

Scan my repo free (read-only)See an example report

Two different things to secure

Your environment: Codex reads files, edits them and runs commands. OpenAI's docs describe two layers: the sandbox mode (what Codex can technically do) and the approval policy (when it must ask you). Your app: once deployed, leaked keys and open database rules are the usual weak spots.

The typical risks

1. Turning the guardrails off

In the default workspace-write mode, Codex can edit and run commands in the workspace and asks before going outside it or using the network. --dangerously-bypass-approvals-and-sandbox (alias --yolo) removes both. OpenAI does not recommend it, and notes that even inside a dev container a malicious project could then exfiltrate anything in that container, including Codex credentials.

2. Prompt injection through network and web content

OpenAI warns that prompt injection can cause the agent to fetch and follow untrusted instructions. Its defaults help: command network access is off, and web search uses a cached index rather than live pages. Be deliberate before enabling network access or live search.

3. Outdated versions

Advisory GHSA-w5fx-fh39-j5rw: Codex CLI 0.2.0 to 0.38.0 could treat a model-generated working directory as the sandbox's writable root, allowing writes and command execution outside the workspace (network restriction unaffected). Fixed in CLI 0.39.0 and IDE extension 0.4.12.

4. Secrets in the code it writes

Keys you paste into a task can end up hardcoded. Keep secrets in environment variables, review diffs before committing, and rotate anything that was exposed; see leaked API keys.

5. Open database rules

If the app uses Supabase from the browser, check RLS on every table: Supabase RLS check.

What the free FixMyVibe scan checks

Paste the URL of a public GitHub repository. The free scan reads the code read-only on a temporary copy that is deleted afterwards, and looks for:

  • Hardcoded secrets in the current files: API keys, tokens, Supabase secret/service_role keys, private keys, and secrets exposed through NEXT_PUBLIC_/VITE_ variables or committed build output.
  • Supabase database rules in your committed SQL migrations: tables without RLS, USING (true)/WITH CHECK (true) policies, policies that trust user_metadata, and similar patterns.

What it does not do: it does not scan your git history (only the current files), it does not connect to your database or your live Codex-built app, and it cannot see private repositories. Dependency checks against the OSV vulnerability database are part of the paid audits, not the free scan. It is an automated code scan, not a penetration test.

Pre-launch checklist

  1. Update the Codex CLI (0.39.0 or later) and IDE extension (0.4.12 or later).
  2. Keep the default sandbox and on-request approvals; avoid --yolo outside an isolated container.
  3. Enable network access or live web search only when a task needs it.
  4. Work on a branch and review every diff before merging.
  5. Search the diff for hardcoded keys; rotate any key that was exposed.
  6. Check RLS on every Supabase table, then scan the repository.
Scan my repo free (read-only)See an example report

FAQ

Does Codex have network access by default?

No. OpenAI's docs say the agent runs with network access off by default, and locally Codex uses an OS-enforced sandbox that typically limits writes to the current workspace, plus an approval policy for actions outside it.

Is --yolo / danger-full-access safe?

OpenAI labels it elevated risk: no sandbox and no approvals, and it doesn't recommend it. Its docs suggest it only inside an isolated container you treat as the security boundary, and only with trusted repositories.

Which Codex versions had the sandbox bypass?

OpenAI's advisory GHSA-w5fx-fh39-j5rw covers Codex CLI 0.2.0 to 0.38.0 (fixed in 0.39.0) and the Codex IDE extension up to 0.4.11 (fixed in 0.4.12): a model-generated working directory could be treated as the sandbox's writable root.

Does FixMyVibe check my Codex configuration?

No. The free scan reads the app code in a public GitHub repository for hardcoded secrets and Supabase RLS problems. It doesn't inspect Codex settings or your machine.

Sources

FixMyVibe is an automated code scan, not a full penetration test, and cannot guarantee that an app is secure. What happens to your code during a scan: see our privacy policy.