Codex Security
github.com/openai/codex-security- Category
- Cybersecurity
- Rank
- No. 773Tools index
Previous survey · No. 763 ·
- Platform
- cli
- Type
- TOOL
- Builder
- @thsottiaux
- GitHub
- 10.7k stars
- Latest release
- npm-v0.1.26
- Date
About
Codex Security is OpenAI's CLI and TypeScript SDK for scanning codebases to find, validate, and remediate security vulnerabilities using Codex models. It supports containerized bulk scans across pinned Git revisions, scan-to-scan comparison to track new or resolved findings, and flexible authentication via ChatGPT sign-in or API keys for CI use.
What it does
Codex Security turns a repository inspection into a structured security workbench. It records findings, evidence, severity, confidence, coverage, exclusions, and remediation, then preserves scan history so teams can distinguish persistent issues from reopened, resolved, or uncertain ones.
Why it's ranked here
The strongest case is disciplined output around an agent-driven scan. Findings carry code evidence, root cause, remediation, confidence, taxonomy, and coverage context. Cost limits, resumable bulk operation, explicit uncertainty, and credential redaction make it unusually practical for repeated engineering work.
What's good
It treats coverage as first-class data instead of implying silence means safety. Deep scans expose worker and stopping controls. Teams can add shared security knowledge, repository-specific instructions, and follow-up prompts. Results support JSON, CSV, and SARIF workflows, while history matching tracks issue status by root cause.
Tradeoffs
Setup is substantial: supported Node releases, Python 3.10 or later, and Codex Security access are required. Some requests and protected findings need separate approval. Verbose diagnostics may expose sensitive data. Missing findings remain unknown when coverage is incomplete, and external providers require their own credentials and model selection.
How to use it well
Use it for teams that want repeatable repository reviews, CI checks, or pinned bulk scans with auditable coverage and history. Set cost and severity gates, preserve private state, and inspect uncertain findings manually. It does not provide access approval or eliminate the need to protect diagnostic logs.
Technical notes+
sdk/typescript/src/api.ts drives scans through CodexSecurity, validates targets and output isolation, prepares authentication, tracks cost, and returns ScanResult. sdk/typescript/src/cli.ts exposes scan, history, comparison, export, provider, deep-scan, and failure-threshold controls. sdk/typescript/src/models.ts defines generated manifest, findings, and coverage contracts. sdk/typescript/src/cost.ts aggregates JSONL session usage across parent and worker threads and enforces estimated cost limits. sdk/typescript/src/errors.ts redacts recognizable credentials at persistence and display boundaries. sdk/typescript/src/runtime.ts hardens credential storage with private permissions, ancestry checks, replacement detection, and Windows ACL inspection.
Observed
- Primary language
- TypeScript
- Packaging
- npm package @openai/codex-security
- Interfaces
- Command-line interface and TypeScript SDK
- Runtime requirements
- Node.js 22.13 or later in the 22.x line, Node.js 24.x or 26.x, plus Python 3.10 or later
- Output formats
- JSON, CSV, and SARIF exports
- Inference providers
- OpenAI, OpenRouter, Fireworks AI, and Amazon Bedrock
- Scan structure
- Structured manifest, findings, coverage, report, artifacts, history, and comparison data
Read from README.md, sdk/typescript/src/cli.ts, sdk/typescript/src/api.ts, sdk/typescript/src/auth.ts, sdk/typescript/src/cost.ts, sdk/typescript/src/index.ts, sdk/typescript/src/config.ts, sdk/typescript/src/errors.ts, sdk/typescript/src/models.ts, sdk/typescript/src/result.ts, sdk/typescript/src/runtime.ts.
What it can do
Scan codebases to find security vulnerabilities
Codebase/repository → List of vulnerabilities
Validate and remediate identified vulnerabilities
Detected vulnerabilities → Remediation actions/fixes
Run containerized bulk scans across pinned Git revisions
Git revisions → Scan results
Compare scans across runs to track new or resolved findings
Two or more scan results → Comparison report of new/resolved findings
Provide TypeScript SDK for programmatic scanning
TypeScript code integrating SDK → Programmatic scan execution
Intel on Codex Security
Tags
Tech Stack
Media
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.