What does an AI security review actually cost? I measured it per run

说明与用途

文章说明如何使用 secfoo CLI 测量 AI 安全评审的成本，包括令牌使用和金钱支出，并说明如何在 CI 管道中强制执行成本阈值。

问题

Teams need to know the cost of each AI security review run to manage budgets and CI gates.

结果

A 30‑line Flask app was scanned in 11.2 s with 2,183 input and 981 output tokens, costing <$0.01. The same run with Codex took 27.5 s and used ~15,201 tokens, but cost was not recorded. secfoo can aggregate spend and enforce a max‑cost gate in CI.

工作流

• Install secfoo with API support
• Set OPENAI_API_KEY
• Run secfoo with --skill sast --agent api --target . --project-name demo --app-id ""
• Observe output table with duration, findings, cost, and run ID
• Repeat run to confirm token consistency
• Run with --agent codex to compare token usage
• Use secfoo cost commands to aggregate spend by agent or skill
• Add --fail-on high --max-cost 2.00 to CI scripts to gate on cost

证据

secfoo run --skill sast --agent api --target . --project-name demo --app-id "" success — SAST — Static Code Analysis Assessment results … AI spend for this run: <$0.01

来源

It finished in 11.2 seconds and reported one finding: the SQL injection in get_user()

来源

Codex runs on a subscription login, so there is no per‑run price to record. A dash is the right answer.

来源

secfoo cost --by agent --project demo AI spend by agent … 2,183 input tokens, 981 output tokens, <$0.01

来源