Signed scan attestations for Codex Security using Daybreak Blue

Codex
,
1

Would it be possible to provide a signed, verifiable attestation after a Codex Security assessment using Daybreak Blue?

For example, the attestation could include the repository or commit hash, scan date, scan scope, report hash, and an OpenAI signature.

The attestation would confirm that a specific version of the software was assessed with Codex Security using Daybreak Blue under the stated scope. It would not be a certification of the software’s overall security.

That would make it easier to show customers or other developers that the scan was actually done. It could also work nicely with releases or CI.

2

This seems like something you could create a skill or workflow for yourself (with essentially the same language as your post). Not sure what the benefit would be to having OAI institute across the board.

3

Thanks for the clear distinction. Codex Security already produces findings and evidence: https://openai.com/index/daybreak-securing-the-world/. We’ll share the request for a verifiable OpenAI-signed record of a specific scan. We don’t have a timeline for that capability.