Codex Security

Overview

Codex Security is a CLI tool and TypeScript SDK developed by OpenAI for finding, validating, and fixing security vulnerabilities in code. It scans repositories, reviews changes in pull requests, tracks findings over time, and integrates directly into CI pipelines.

Codex Security is powered by the same model capabilities that drive Codex and ChatGPT, giving developers a security scanning tool that understands code semantics rather than relying solely on static analysis patterns.

The project is distributed under the Apache-2.0 license and supports both interactive CLI usage and programmatic SDK integration.

Features

• Repository scanning: npx codex-security scan . for quick, full-repo security analysis
• Change review mode: Focuses security checks on pull requests and diffs for efficient CI integration
• TypeScript SDK: Import CodexSecurity for programmatic access in CI/CD pipelines
• Finding tracking: Persist and compare security findings over time to track regressions
• CI-native: Designed for integration into GitHub Actions, GitLab CI, and other pipelines
• Dual auth: Supports both ChatGPT sign-in and OPENAI_API_KEY authentication

Installation

Prerequisites:

• Node.js 22+
• Python 3.10+ (for some backend components)

CLI usage:

# Login (interactive — ChatGPT sign-in or API key)
npx codex-security login

# Scan current repository
npx codex-security scan .

# Scan a specific path
npx codex-security scan ./src

TypeScript SDK:

npm install @openai/codex-security

Quick Start

import { CodexSecurity } from "@openai/codex-security";

const client = new CodexSecurity({
  apiKey: process.env.OPENAI_API_KEY,
});

const findings = await client.scan({
  path: ".",
  mode: "pr", // scan only changed files
});

console.log(`Found ${findings.length} security issues`);
for (const f of findings) {
  console.log(`${f.severity}: ${f.message} at ${f.location}`);
}

Core Concepts

• Scan: A full repository or targeted (PR/diff) security analysis run.
• Finding: A detected vulnerability with severity, location, message, and fix suggestion.
• Tracking: Findings can be persisted to a state directory (via CODEX_SECURITY_STATE_DIR) and compared across runs to detect regressions or improvements.
• CI Mode: When run in a non-interactive environment, Codex Security uses OPENAI_API_KEY automatically.

Examples

GitHub Actions CI Integration

- name: Security Scan
  run: npx codex-security scan .
  env:
    OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

PR-Diff Scanning

npx codex-security scan . --mode pr

Pros

• ✅ Semantic code understanding (LLM-powered, not pattern-only)
• ✅ CLI + SDK dual distribution
• ✅ PR-aware scanning (only changed code)
• ✅ Finding tracking across runs
• ✅ Apache-2.0 license
• ✅ Direct OpenAI model access

Cons

• ❌ Requires API key or ChatGPT sign-in (not fully offline)
• ❌ New tool — smaller community and fewer integrations
• ❌ Requires Node.js 22+
• ❌ Cost of API calls for large repos

When to Use

Codex Security is ideal for:

• CI/CD pipelines that need semantic security scanning beyond static analysis
• Pull request review workflows that focus on changed code
• Teams using ChatGPT/Codex who want to leverage the same model for security
• Projects that want to track vulnerability regressions over time

Resources

• GitHub Repository
• OpenAI Security Documentation