False positive cybersecurity filtering hides legitimate software verification output and blocks release auditing

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.715.72359

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

While using Codex for defensive software engineering and release verification, successful command outputs are frequently replaced with:

"This content can't be shown"

The commands complete successfully, but the resulting verification evidence is hidden by the application.

This significantly impacts legitimate development workflows, including:

• PostgreSQL migration verification

• Release integrity verification

• OCI image digest verification

• SBOM / SPDX validation

• SLSA provenance verification

• Bundle checksum verification

• GitHub Release auditing

• Database constraint validation

• Runtime compatibility verification

The hidden output contains verification logs and audit evidence, not exploit instructions or offensive security content.

Because the verification evidence cannot be reviewed, independent release auditing becomes impossible even though the commands execute successfully.

This appears to be a false positive in the cybersecurity safety classifier.

What steps can reproduce the bug?

Feedback ID: 019f8f5f-a7b6-7d00-bcbc-23d059b1815b

What is the expected behavior?

Codex should display successful verification and audit output for legitimate software engineering tasks.

The commands already execute successfully, but the resulting logs are hidden by the cybersecurity safety filter.

Expected behavior:

• Display verification logs after successful execution.
• Do not suppress defensive software verification output.
• Allow users to review release evidence, migration validation, digest verification, provenance validation, and integrity checks on their own repositories.
• If additional safety review is required, consider providing a warning rather than completely hiding successful output.

These tasks are part of normal release engineering and software supply-chain verification, not offensive cybersecurity activities.

Additional information

This issue has a significant impact on our development workflow.

Our project is an AI infrastructure platform with a strong focus on software integrity, release verification, governance, and compliance. A typical verification session includes:

• PostgreSQL migration validation
• Release integrity verification
• OCI image digest verification
• SBOM / SPDX verification
• SLSA provenance verification
• Bundle checksum verification
• Runtime compatibility testing

These are defensive engineering activities performed on our own repositories.

When verification output is hidden, independent release auditing cannot be completed because the evidence is no longer reviewable.

This appears to be a false positive in the cybersecurity classifier rather than a policy violation.

Feedback ID:
019f8f5f-a7b6-7d00-bcbc-23d059b1815b