
Security News
Node.js Drops Bug Bounty Rewards After Funding Dries Up
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.
A lightweight web interface for Codex that runs on top of the Codex app-server, allowing remote access from any browser
Codex UI in your browser. No drama. One command.
Yes, that is your Codex desktop app experience exposed over web UI. Yes, it runs cross-platform.
██████╗ ██████╗ ██████╗ ███████╗██╗ ██╗██╗ ██╗██╗
██╔════╝██╔═══██╗██╔══██╗██╔════╝╚██╗██╔╝██║ ██║██║
██║ ██║ ██║██║ ██║█████╗ ╚███╔╝ ██║ ██║██║
██║ ██║ ██║██║ ██║██╔══╝ ██╔██╗ ██║ ██║██║
╚██████╗╚██████╔╝██████╔╝███████╗██╔╝ ██╗╚██████╔╝██║
╚═════╝ ╚═════╝ ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝ ╚═╝
codexapp is a lightweight bridge that gives you a browser-accessible UI for Codex app-server workflows.
You run one command. It starts a local web server. You open it from your machine, your LAN, or wherever your setup allows.
TL;DR 🧠: Codex app UI, unlocked for Linux, Windows, and Termux-powered Android setups.
The main event.
# 🔓 Run instantly (recommended)
npx codexapp
# 🌐 Then open in browser
# http://localhost:18923
By default, codexapp now also starts:
cloudflared tunnel --url http://localhost:<port>
It prints the tunnel URL, terminal QR code, and password together in startup output.
Use --no-tunnel to disable this behavior.
node -v # should be 18+
npx codexapp
node -v # 18+
npx codexapp
pkg update && pkg upgrade -y
pkg install nodejs -y
npx codexapp
Android background requirements:
codexapp running in the current Termux session (do not close it).Termux.termux-wake-lock
npx codexapp again.If you want to use codexUI from iPhone or iPad Safari, serving it over HTTPS is recommended.
A practical private setup is to run codexUI locally and publish it inside your tailnet with Tailscale Serve:
npx codexapp --no-tunnel --port 5999
tailscale serve --bg 5999
Then open:
https://<your-machine>.<your-tailnet>.ts.net
This setup worked well in practice for:
Notes:
The payload.
npx codexapphttp://localhost:18923Set these environment variables before starting codexapp:
export TELEGRAM_BOT_TOKEN="<your-telegram-bot-token>"
export TELEGRAM_DEFAULT_CWD="$PWD" # optional, defaults to current working directory
npx codexapp
Bot commands:
/newthread create and map a new Codex thread for this Telegram chat/thread <threadId> map current Telegram chat to an existing threadNot just launch. Actual UX upgrades.
New Project (N))SkillCard select emit compatibilityhold to dictate -> transcribe -> append text)| 🔥 Use Case | 💥 What You Get |
|---|---|
| 💻 Linux workstation | Run Codex UI in browser without depending on desktop shell |
| 🪟 Windows machine | Launch web UI and access from Chrome/Edge quickly |
| 📱 Termux on Android | Start service in Termux and control from mobile browser |
| 🧪 Remote dev box | Keep Codex process on server, view UI from client device |
| 🌐 LAN sharing | Open UI from another device on same network |
| 🧰 Headless workflows | Keep terminal + browser split for productivity |
| 🔌 Custom routing | Put behind reverse proxy/tunnel if needed |
| ⚡ Fast experiments | npx run without full global setup |



┌─────────────────────────────┐
│ Browser (Desktop/Mobile) │
└──────────────┬──────────────┘
│ HTTP/WebSocket
┌──────────────▼──────────────┐
│ codexapp │
│ (Express + Vue UI bridge) │
└──────────────┬──────────────┘
│ RPC/Bridge calls
┌──────────────▼──────────────┐
│ Codex App Server │
└─────────────────────────────┘
18+| ❌ Problem | ✅ Fix |
|---|---|
| Port already in use | Run on a free port or stop old process |
npx fails | Update npm/node, then retry |
| Termux install fails | pkg update && pkg upgrade then reinstall nodejs |
| Can’t open from other device | Check firewall, bind address, and LAN routing |
Issues and PRs are welcome.
Bring bug reports, platform notes, and setup improvements.
If you believe Codex UI should be accessible from any machine, any OS, any screen, star this project and share it. ⭐
Forked from pavel-voronin/codex-web-local by Pavel Voronin.
FAQs
A lightweight web interface for Codex that runs on top of the Codex app-server, allowing remote access from any browser
We found that codexapp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.