Supercov vs Codex CLI for security review

The difference

Codex CLI reviews a repository as an agent: it reads the code, follows it across files and writes up what it finds. Supercov runs a fixed set of twelve security checks on each file. Codex CLI finds far more. Supercov finishes in seconds instead of minutes, for about 1% of the cost.

Results

72 deliberately vulnerable repositories, 2,016 labelled vulnerabilities.

	Supercov 2.0.1	Codex CLI, GPT Daybreak Blue	Codex CLI, GPT-5.6 Sol	Codex CLI, GPT-6 Astra
F1	0.42	0.71	0.70	0.49
Finds	43%	82%	79%	54%
Right	42%	63%	62%	45%
Median time	10 s	5.4 min	8.8 min	6.4 min
Cost per repository	5¢	$3.78	$3.87	$6.99

By language

F1	Supercov	GPT Daybreak Blue	GPT-5.6 Sol	GPT-6 Astra
Python, 32 repositories	0.54	0.79	0.77	0.52
TypeScript, 27	0.36	0.65	0.64	0.47
JavaScript, 13	0.34	0.74	0.67	0.47

The newest model is not the most accurate: GPT-6 Astra costs the most and scores well below GPT Daybreak Blue.

Choose Codex CLI when

you want the most complete review you can get, such as before a release;
a few dollars and several minutes per repository are fine;
you need problems that span files, like a route missing its authorization check. Supercov finds 11% of those.

Choose Supercov when

your agent should check every change, and waiting minutes each time is not an option;
you run it across many repositories, where dollars per run add up;
you want the same twelve checks every time, so results compare run to run.

Use both

Run Supercov on each change and Codex CLI before a release. See Accuracy, speed and cost for how this was measured.