OpenAI Codex security directory

Build Web Apps

Published by OpenAI

High risk

Helps Codex create and refine frontend web applications. Develop visual concepts and components, then test behavior in the browser. Includes React/Next.js, shadcn/ui, Stripe and Supabase/Postgres guidance.

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

  • Drives Browser plugin / Playwright against local apps: Can programmatically control a browser, including navigation, form input, clicks, capture, or page inspection.
  • Writes and overwrites project source and component files: Can read, create, or change files on the local filesystem or in a selected project.
  • Fetches docs URLs and registry items from arbitrary URLs: Can send prompts, files, queries, or connected-service data to an external service.
  • Runs unpinned npx shadcn@latest and local dev servers/Playwright scripts: Can execute code, commands, scripts, unrestricted queries, or dynamic gateway actions.

Available capabilities

This add-on exposes 6 tools or capabilities.

  • frontend-app-builder
  • frontend-testing-debugging
  • react-best-practices
  • shadcn
  • stripe-best-practices
  • supabase-postgres-best-practices

The interactive security report will load automatically.