Codex Security

Overview

Codex Security is OpenAI's security tooling for scanning application code, investigating findings, and reviewing fixes. It reports evidence to support vulnerability investigation and remediation, and can be used through Codex workflows or automated with the CLI and TypeScript SDK.

Key Features

• Scans repositories, selected paths, or Git changes, with deep scans repeating standard scans and returning deduplicated findings.
• Validates candidate findings, generates patches, and verifies existing fixes.
• Drafts SECURITY.md policies and saves threat models for later review.
• Browses saved scans and findings, identifies duplicates, assesses severity against a custom rubric, and suggests owners from source and Git history.
• Imports third-party scanner findings and supports export as SARIF, JSON, and CSV, with tracking in Linear, Jira, or GitHub.
• Automates scans across repositories or project components, including in CI and containers.

Use Cases

• Scan a local repository interactively in Codex and work through findings.
• Run repeatable terminal scans or add security checks to CI.
• Run scans and handle results inside an application or developer tool with the TypeScript SDK.
• Scan connected GitHub repositories in Codex cloud or monitor new commits with Codex Security Cloud.

Getting Started

• For a first local scan, use the Codex Security plugin in the ChatGPT desktop app or Codex CLI.
• Install the CLI globally with npm install --global @openai/codex-security, sign in with cs login, then run cs scan . from the repository directory.
• When the scan completes, open the Markdown report at the REPORT path shown in the terminal.

Deployment & Requirements

• CLI requires Node.js 22.13.0+ within 22.x, or Node.js 24.x or 26.x, and Python 3.10+; Python 3.10 also requires tomli.
• Scans using OpenAI inference require Codex Security access; CI scans need OPENAI_API_KEY or CODEX_API_KEY set in the scan process environment.
• Codex Security Cloud requires workspace access, a GitHub connection, and a compatible Codex cloud environment.

Before You Adopt

• License: Apache-2.0. Review its terms before using, modifying, or distributing the project.