Scanner deep-dive
Daybreak Blue by OpenAI ↗
General-Purpose LLM · codex-cli · scored on 140/140 repositories. Strict scoring (unfinished repos counted as misses).
Methodology note
Full coverage; subscription-metered. gpt-daybreak-blue-latest is an OpenAI Codex CLI alias that, per OpenAI's own model docs, currently resolves to the same underlying weights as gpt-5.6-sol — the difference is the Daybreak program's defensive-cybersecurity system instructions and safety calibration, not a different model. Despite that, at matched high reasoning effort it scores well above plain Sol on both languages (Python F3 80.0 vs 77.8, TS/JS F3 79.2 vs 72.1, Overall 79.5 vs 74.7) and on a same-repo pilot the gap was starker still (F3 88.3 vs 57.1). Whatever the Daybreak instructions change, it changes scanning behavior substantially. OpenAI's official Daybreak pricing card lists this alias at the identical rate as gpt-5.6-sol ($4.00/$20.00 per 1M input/output, short context), which is what the cost figure here uses -- computed from Codex's reported token usage, not billed spend, same convention as Sol. All 74 TypeScript / JS repositories were scanned on 2026-09-04 with the TS/JS prompt (hash sha256:45a1200d61e6); all 66 Python repositories were scanned on 2026-09-05 with the standard prompt. All 140 runs validated first time.79.5
F3 (strict)
77.4
F2 (strict)
81.8%
Recall (strict)
64.0%
Precision
140/140
Repos scored
gpt-daybreak-blue-latest
Model
$548
Total cost
347s
Avg latency
§
Per-repository breakdown
Each bar shows true positives, false positives, and misses on one repository; bar length is proportional to that repo's labeled vulnerabilities. Ranked by F2.
| Repository | TP | FP | FN | Recall % | F2 |
|---|---|---|---|---|---|
| intentionally-vulnerable-python-application | 7 | 0 | 0 | 100.0 | 100.0 |
| juice-shop | 81 | 0 | 0 | 100.0 | 100.0 |
| lets-be-bad-guys | 24 | 0 | 0 | 100.0 | 100.0 |
| pythonssti | 2 | 0 | 0 | 100.0 | 100.0 |
| react-test-bench | 1 | 0 | 0 | 100.0 | 100.0 |
| simply-vulnerable-react | 1 | 0 | 0 | 100.0 | 100.0 |
| vampi | 15 | 0 | 0 | 100.0 | 100.0 |
| vfapi | 9 | 0 | 0 | 100.0 | 100.0 |
| vc-claude-code-seeded-v2-education-lms-django | 32 | 0 | 0 | 100.0 | 100.0 |
| vc-claude-code-seeded-v2-legal-case-django | 31 | 0 | 0 | 100.0 | 100.0 |
| vc-claude-code-seeded-v3-crm-saas-nestjs-angular | 49 | 0 | 0 | 100.0 | 100.0 |
| vc-codex-high-seeded-v2-fintech-lending-fastapi | 29 | 0 | 0 | 100.0 | 100.0 |
| vc-codex-high-seeded-v3-property-management-fastify-vue | 42 | 0 | 0 | 100.0 | 100.0 |
| vc-codex-seeded-v2-education-lms-django | 35 | 0 | 0 | 100.0 | 100.0 |
| vc-codex-seeded-v2-healthcare-clinic-django | 41 | 0 | 0 | 100.0 | 100.0 |
| vc-codex-seeded-v2-support-desk-fastapi | 30 | 0 | 0 | 100.0 | 100.0 |
| vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue | 19 | 0 | 0 | 100.0 | 100.0 |
| vc-kimi-code-seeded-v2-healthcare-clinic-django | 30 | 0 | 0 | 100.0 | 100.0 |
| vc-kimi-code-seeded-v2-marketplace-commerce-fastapi | 27 | 0 | 0 | 100.0 | 100.0 |
| vc-kimi-code-seeded-v3-crm-saas-nestjs-angular | 40 | 0 | 0 | 100.0 | 100.0 |
| vc-kimi-code-seeded-v3-hr-payroll-remix | 36 | 0 | 0 | 100.0 | 100.0 |
| vc-claude-code-seeded-v3-hr-payroll-remix | 37 | 1 | 0 | 100.0 | 99.5 |
| vc-claude-code-seeded-v2-support-desk-fastapi | 34 | 2 | 0 | 100.0 | 98.8 |
| vc-codex-seeded-v2-crm-saas-django | 34 | 2 | 0 | 100.0 | 98.8 |
| vc-claude-code-seeded-v2-hr-payroll-django | 27 | 2 | 0 | 100.0 | 98.5 |
| vc-claude-code-seeded-v2-property-management-fastapi | 33 | 3 | 0 | 100.0 | 98.2 |
| insecure-web | 9 | 1 | 0 | 100.0 | 97.8 |
| vc-codex-seeded-v2-legal-case-django | 33 | 4 | 0 | 100.0 | 97.6 |
| vc-claude-code-seeded-v2-crm-saas-django | 28 | 4 | 0 | 100.0 | 97.2 |
| vc-codex-high-seeded-v2-healthcare-clinic-django | 26 | 4 | 0 | 100.0 | 97.0 |
| vc-claude-code-seeded-v3-marketplace-commerce-express | 40 | 8 | 0 | 100.0 | 96.2 |
| dvws-node | 77 | 16 | 0 | 100.0 | 96.0 |
| dsvw | 26 | 2 | 1 | 96.3 | 95.6 |
| vc-codex-seeded-v2-hr-payroll-django | 37 | 2 | 2 | 94.9 | 94.9 |
| vc-claude-code-seeded-v2-logistics-dispatch-fastapi | 33 | 9 | 0 | 100.0 | 94.8 |
| vc-codex-high-seeded-v2-property-management-fastapi | 26 | 8 | 0 | 100.0 | 94.2 |
| vc-codex-high-seeded-v2-marketplace-commerce-fastapi | 25 | 8 | 0 | 100.0 | 94.0 |
| vc-kimi-code-seeded-v2-crm-saas-django | 27 | 9 | 0 | 100.0 | 93.8 |
| vc-claude-code-seeded-v2-healthcare-clinic-django | 29 | 10 | 0 | 100.0 | 93.5 |
| vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs | 28 | 10 | 0 | 100.0 | 93.3 |
| vc-claude-code-seeded-v2-fintech-lending-fastapi | 29 | 12 | 0 | 100.0 | 92.4 |
| node-api-goat | 7 | 3 | 0 | 100.0 | 92.1 |
| vc-codex-seeded-v2-logistics-dispatch-fastapi | 30 | 13 | 0 | 100.0 | 92.0 |
| vc-kimi-code-seeded-v2-education-lms-django | 28 | 13 | 0 | 100.0 | 91.5 |
| ivna | 19 | 9 | 0 | 100.0 | 91.3 |
| vulnerable-nodejs | 19 | 10 | 0 | 100.0 | 90.5 |
| vc-kimi-code-seeded-v2-legal-case-django | 26 | 14 | 0 | 100.0 | 90.3 |
| vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue | 44 | 20 | 1 | 97.8 | 90.2 |
| vc-codex-high-seeded-v2-hr-payroll-django | 24 | 11 | 1 | 96.0 | 88.9 |
| vc-codex-high-seeded-v3-healthcare-clinic-nextjs | 40 | 17 | 2 | 95.2 | 88.9 |
| vc-claude-code-seeded-v3-support-desk-nestjs-angular | 41 | 28 | 0 | 100.0 | 88.0 |
| vc-claude-code-seeded-v3-legal-case-remix | 27 | 15 | 1 | 96.4 | 87.7 |
| dsvpwa | 30 | 14 | 2 | 93.8 | 87.2 |
| vulnerable-node | 20 | 11 | 1 | 95.2 | 87.0 |
| juice-shop-goof | 49 | 29 | 2 | 96.1 | 86.9 |
| dvna | 17 | 13 | 0 | 100.0 | 86.7 |
| vc-kimi-code-seeded-v3-fintech-lending-express | 39 | 18 | 3 | 92.9 | 86.7 |
| vc-codex-high-seeded-v3-support-desk-nestjs-angular | 33 | 18 | 2 | 94.3 | 86.4 |
| dvblab | 20 | 8 | 2 | 90.9 | 86.2 |
| vulnnodeapp | 26 | 9 | 3 | 89.7 | 86.1 |
| vc-codex-high-seeded-v3-education-lms-nextjs | 43 | 15 | 5 | 89.6 | 86.0 |
| vc-kimi-code-seeded-v2-hr-payroll-django | 28 | 20 | 1 | 96.5 | 85.4 |
| vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue | 28 | 25 | 0 | 100.0 | 84.8 |
| vc-kimi-code-seeded-v3-legal-case-remix | 37 | 18 | 4 | 90.2 | 84.5 |
| vc-codex-high-seeded-v3-marketplace-commerce-express | 39 | 17 | 5 | 88.6 | 84.1 |
| nextjs-vulnerable-app | 1 | 1 | 0 | 100.0 | 83.3 |
| vc-codex-high-seeded-v3-crm-saas-nestjs-angular | 33 | 17 | 4 | 89.2 | 83.3 |
| vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express | 19 | 11 | 2 | 90.5 | 83.3 |
| vulnerable-app-angular | 8 | 9 | 0 | 100.0 | 81.6 |
| vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix | 23 | 14 | 3 | 88.5 | 81.6 |
| vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular | 21 | 21 | 1 | 95.5 | 80.8 |
| vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs | 21 | 14 | 3 | 87.5 | 80.2 |
| vc-kimi-code-seeded-v3-property-management-fastify-vue | 30 | 30 | 2 | 93.8 | 79.8 |
| vc-codex-high-seeded-v3-fintech-lending-express | 32 | 13 | 7 | 82.0 | 79.6 |
| vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue | 38 | 28 | 6 | 86.4 | 78.5 |
| vc-claude-code-seeded-v3-education-lms-nextjs | 33 | 27 | 5 | 86.8 | 77.8 |
| vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular | 21 | 18 | 3 | 87.5 | 77.8 |
| damn-vulnerable-graphql-application | 28 | 10 | 8 | 77.8 | 76.9 |
| vc-codex-seeded-v2-fintech-lending-fastapi | 28 | 6 | 9 | 75.7 | 76.9 |
| vc-deepseek-v4-pro-seeded-v3-legal-case-remix | 22 | 21 | 3 | 88.0 | 76.9 |
| vc-codex-high-seeded-v3-legal-case-remix | 37 | 17 | 10 | 78.7 | 76.4 |
| vc-kimi-code-seeded-v3-marketplace-commerce-express | 39 | 45 | 4 | 90.7 | 76.2 |
| vc-claude-code-seeded-v3-fintech-lending-express | 32 | 20 | 8 | 80.0 | 75.5 |
| ninjasworkout | 20 | 25 | 2 | 90.9 | 75.2 |
| vc-deepseek-v4-flash-seeded-v3-legal-case-remix | 20 | 26 | 2 | 90.9 | 74.6 |
| nodegoat | 22 | 14 | 6 | 78.6 | 74.3 |
| threatbyte | 20 | 11 | 6 | 76.9 | 74.1 |
| vc-kimi-code-seeded-v2-property-management-fastapi | 24 | 18 | 6 | 80.0 | 74.1 |
| vc-kimi-code-seeded-v2-fintech-lending-fastapi | 25 | 12 | 8 | 75.8 | 74.0 |
| vc-codex-high-seeded-v2-support-desk-fastapi | 22 | 15 | 6 | 78.6 | 73.8 |
| vc-codex-high-seeded-v2-education-lms-django | 19 | 10 | 6 | 76.0 | 73.6 |
| vc-codex-high-seeded-v2-logistics-dispatch-fastapi | 22 | 12 | 7 | 75.9 | 73.3 |
| vc-kimi-code-seeded-v2-support-desk-fastapi | 22 | 16 | 6 | 78.6 | 73.3 |
| extremely-vulnerable-flask-app | 23 | 8 | 9 | 71.9 | 72.3 |
| dvpwa | 16 | 5 | 7 | 69.6 | 70.8 |
| python-app | 14 | 1 | 7 | 66.7 | 70.7 |
| xvna | 10 | 14 | 2 | 83.3 | 69.4 |
| vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular | 19 | 42 | 0 | 100.0 | 69.3 |
| vc-kimi-code-seeded-v2-logistics-dispatch-fastapi | 24 | 28 | 7 | 77.4 | 68.2 |
| vulnerable-tornado-app | 10 | 8 | 4 | 71.4 | 67.6 |
| vc-claude-code-seeded-v3-healthcare-clinic-nextjs | 29 | 14 | 14 | 67.4 | 67.4 |
| vc-claude-code-seeded-v2-marketplace-commerce-fastapi | 21 | 7 | 11 | 65.6 | 67.3 |
| vc-codex-high-seeded-v2-crm-saas-django | 17 | 11 | 8 | 68.0 | 66.4 |
| vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue | 23 | 52 | 2 | 92.0 | 65.7 |
| vuln-node-express | 3 | 0 | 2 | 60.0 | 65.2 |
| vulnerable-api | 9 | 4 | 5 | 64.3 | 65.2 |
| vc-deepseek-v4-pro-seeded-v3-fintech-lending-express | 20 | 27 | 7 | 74.1 | 64.5 |
| owasp-web-playground | 18 | 10 | 10 | 64.3 | 64.3 |
| python-insecure-app | 5 | 2 | 3 | 62.5 | 64.1 |
| vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue | 33 | 26 | 18 | 64.7 | 62.7 |
| vc-codex-seeded-v2-property-management-fastapi | 19 | 11 | 12 | 61.3 | 61.7 |
| vulnerable-rest-api-owasp-2023 | 12 | 27 | 3 | 80.0 | 60.6 |
| vc-claude-code-seeded-v3-property-management-fastify-vue | 22 | 38 | 10 | 68.8 | 58.5 |
| vulnpy | 40 | 9 | 40 | 50.0 | 54.2 |
| flask-xss | 15 | 5 | 15 | 50.0 | 53.6 |
| vulnerable-flask-app | 11 | 8 | 10 | 52.4 | 53.4 |
| vulpy | 29 | 17 | 28 | 50.9 | 52.9 |
| vc-codex-seeded-v2-marketplace-commerce-fastapi | 14 | 4 | 15 | 48.3 | 52.2 |
| pygoat | 39 | 28 | 39 | 50.0 | 51.5 |
| vc-codex-high-seeded-v3-hr-payroll-remix | 22 | 25 | 20 | 52.4 | 51.2 |
| vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express | 14 | 21 | 12 | 53.8 | 50.4 |
| nodejs-goof | 9 | 13 | 8 | 52.9 | 50.0 |
| vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix | 11 | 30 | 7 | 61.1 | 48.7 |
| damn-vulnerable-flask-application | 7 | 9 | 7 | 50.0 | 48.6 |
| vc-kimi-code-seeded-v3-education-lms-nextjs | 24 | 48 | 22 | 52.2 | 46.9 |
| oss-oopssec-store | 20 | 34 | 20 | 50.0 | 46.7 |
| react-security | 4 | 11 | 3 | 57.1 | 46.5 |
| djangoat | 23 | 18 | 29 | 44.2 | 46.2 |
| vc-kimi-code-seeded-v3-support-desk-nestjs-angular | 16 | 30 | 16 | 50.0 | 46.0 |
| vc-kimi-code-seeded-v3-healthcare-clinic-nextjs | 18 | 35 | 18 | 50.0 | 45.7 |
| vuln-node-express-swagger | 23 | 34 | 26 | 46.9 | 45.5 |
| vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs | 13 | 28 | 13 | 50.0 | 44.8 |
| vc-deepseek-v4-flash-seeded-v3-fintech-lending-express | 12 | 35 | 10 | 54.5 | 44.4 |
| vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue | 16 | 51 | 14 | 53.3 | 42.8 |
| vulnerable-react-fatih | 4 | 17 | 3 | 57.1 | 40.8 |
| reactvulna | 1 | 8 | 0 | 100.0 | 38.5 |
| vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs | 11 | 31 | 16 | 40.7 | 36.7 |
| vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular | 11 | 22 | 19 | 36.7 | 35.9 |
| vc-codex-high-seeded-v2-legal-case-django | 8 | 25 | 17 | 32.0 | 30.1 |
| vulnerable-python-apps | 6 | 8 | 16 | 27.3 | 29.4 |
§
Detection by severity
| Severity | TP | FP | FN | Recall % |
|---|---|---|---|---|
| Critical | 144 | 0 | 14 | 91.1 |
| High | 2350 | 0 | 498 | 82.5 |
| Medium | 776 | 2 | 190 | 80.3 |
| Low | 113 | 0 | 53 | 68.1 |
§
Detection by vulnerability class
| CWE family | TP | FP | FN | Recall % |
|---|---|---|---|---|
| Open Redirect | 87 | 0 | 1 | 98.9 |
| Command / OS Injection | 131 | 0 | 5 | 96.3 |
| XPath Injection | 16 | 0 | 1 | 94.1 |
| Insecure Deserialization | 45 | 0 | 3 | 93.8 |
| Path Traversal | 95 | 0 | 9 | 91.3 |
| XML External Entities | 58 | 0 | 6 | 90.6 |
| SQL Injection | 139 | 0 | 15 | 90.3 |
| Code Injection / RFI | 72 | 0 | 8 | 90.0 |
| Broken Access Control / IDOR | 204 | 0 | 28 | 87.9 |
| Security Misconfiguration | 174 | 0 | 30 | 85.3 |
| Server-Side Request Forgery | 77 | 1 | 16 | 82.8 |
| Cross-Site Scripting | 168 | 0 | 38 | 81.6 |
| Sensitive Data Exposure | 282 | 0 | 67 | 80.8 |
| Other | 1507 | 0 | 378 | 79.9 |
| Missing Authentication / Authorization | 125 | 0 | 48 | 72.3 |
| Denial of Service | 61 | 0 | 26 | 70.1 |
| Hardcoded Credentials | 141 | 1 | 75 | 65.3 |
| HTTP Header Injection | 1 | 0 | 1 | 50.0 |
§
LLM operational metrics
2,616,467
Avg input tokens
24,111
Avg output tokens
2,653,601
Avg total tokens
347s
Avg latency / repo
0.0%
JSON repair rate
140
Total runs
§
Cost
$548
Total cost
$3.91
Cost / run
$0.074
Cost / 100 LOC
741,034
Lines of code scanned
140
Successful runs