Jonathan SingerandClaude Fable 5
d35af02e47
Add an OAuth-based path to run Strix on a user's ChatGPT Plus/Pro subscription instead of a metered API key, modeled on OpenAI's Codex CLI. Auth: - strix/auth: Codex OAuth login (authorization-code + PKCE), a 0600 token store, refresh-on-expiry, and an AsyncOpenAI client that routes inference through the ChatGPT backend (chatgpt.com/backend-api/codex) with a per-request auth hook so long scans survive token expiry. - `strix auth login|logout|status` CLI (browser loopback on :1455 with a manual-paste fallback); STRIX_AUTH_MODE=subscription persisted to config. Inference wiring: - Subscription branch in configure_sdk_model_defaults installs the Codex client and the Responses API. - _CodexResponsesModel always streams (the backend rejects non-streamed requests) and aggregates back for the non-streaming get_response path. - store=false + encrypted reasoning for the stateless backend; models coerced to plan-available names (default gpt-5.4 — 5.5+ apply stricter content moderation that interferes with security testing). UX / reporting: - Track tokens but report $0.00 in the TUI, completion panel, and web viewer run details; record auth_mode in run.json and PostHog/Scarf. - Graceful, actionable errors for unavailable models and expired sign-in. - Restyled OAuth callback page (Strix branding + link to strix.ai). Tests: PKCE/URL/redirect parsing, token refresh + account-id, streaming aggregation, cost zeroing, CLI routing/provider aliasing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Overview
To help make Strix better for everyone, we collect anonymized data that helps us understand how to better improve our AI security agent for our users, guide the addition of new features, and fix common errors and bugs. This feedback loop is crucial for improving Strix's capabilities and user experience.
We use PostHog, an open-source analytics platform, for data collection and analysis, along with Scarf. Our telemetry implementation is fully transparent - you can review the source code (posthog.py, scarf.py) to see exactly what we track.
Telemetry Policy
Privacy is our priority. All collected data is anonymized by default. Each session gets a random UUID that is not persisted or tied to you. Your code, scan targets, vulnerability details, and findings always remain private and are never collected.
What We Track
We collect only very basic usage data including:
Session Errors: Duration and error types (not messages or stack traces)
System Context: OS type, architecture, Strix version
Scan Context: Scan mode (quick/standard/deep), scan type (whitebox/blackbox)
Model Usage: Which LLM model is being used (not prompts or responses)
Feature Usage: Which built-in skills are loaded
Aggregate Metrics: Vulnerability counts by severity and weakness category (CWE)
What We Never Collect
- Usernames, or any identifying information
- Scan targets, file paths, target URLs, or domains
- Vulnerability details, descriptions, or code
- LLM requests and responses
How to Opt Out
Telemetry in Strix is entirely optional:
export STRIX_TELEMETRY=0
You can set this environment variable before running Strix to disable all telemetry.