{"slug": "openai-just-open-sourced-codex-security", "title": "OpenAI just open-sourced Codex Security", "summary": "OpenAI has open-sourced Codex Security, a CLI and TypeScript SDK for finding, validating, and reviewing security issues in code, now available on npm as @openai/codex-security. The tool supports macOS, Linux, and Windows, requires Node.js 22 or later, and can scan repositories using OpenAI account credentials or an API key.", "body_md": "Codex Security is an open-source CLI and TypeScript SDK for finding, validating, and reviewing security issues in code you own or have permission to assess.\n\nNote\n\nThis package follows semantic versioning. Its public API may change between\nminor versions before `1.0.0`\n\n.\n\nThe SDK and CLI support macOS, Linux, and Windows and require Node.js 22 or\nlater. Scanning and exporting findings also require Python 3.10 or later. If\nyou use Python 3.10, install the `tomli`\n\npackage. Python is not needed to\ninstall the package or run `--help`\n\nand `--version`\n\n.\n\nSign in with your OpenAI account or provide an OpenAI API key before running a scan. Scan only repositories you own or have explicit permission to assess.\n\n```\nnpm install @openai/codex-security\nnpx codex-security login\nnpx codex-security scan /path/to/repo\n```\n\nRun `npx codex-security --help`\n\nto see all commands and\n`npx codex-security scan --help`\n\nfor scan options.\n\nOn a remote or headless machine, use `npx codex-security login --device-auth`\n\n.\nFor CI and other unattended scans, set `OPENAI_API_KEY`\n\nor `CODEX_API_KEY`\n\nusing\nyour shell, CI secret, or secret manager.\n\nOn Windows, set an API key in PowerShell with:\n\n```\n$env:OPENAI_API_KEY = \"<your-api-key>\"\nnpx codex-security scan C:\\code\\repository\n```\n\nTo store an API key, pass it on stdin:\n\n```\nprintenv OPENAI_API_KEY | npx codex-security login --with-api-key\n```\n\nUse `npx codex-security login status`\n\nto check the stored sign-in and\n`npx codex-security logout`\n\nto remove it. Codex Security reuses an existing\nfile-based Codex sign-in. If Codex stores credentials in the system keyring,\nrun `npx codex-security login`\n\nonce before scanning.\n\nAn environment API key takes precedence over a stored sign-in. Unset both\n`OPENAI_API_KEY`\n\nand `CODEX_API_KEY`\n\nto use your ChatGPT sign-in. The login\nstatus command reports the effective credential source without printing its\nvalue, including when no stored sign-in exists.\n\nScan a subset of a repository or write machine-readable results:\n\n```\nnpx codex-security scan /path/to/repo --model gpt-5.6-terra\nnpx codex-security scan /path/to/repo --path src --path tests\nnpx codex-security scan /path/to/repo --knowledge-base /path/to/threat-models --knowledge-base /path/to/architecture.pdf\nnpx codex-security scan /path/to/repo --diff origin/main --json\nnpx codex-security scan /path/to/repo --output-dir /path/outside/repo/results\nnpx codex-security scan /path/to/repo --output-dir /path/outside/repo/results --archive-existing\nnpx codex-security scan /path/to/repo --dry-run\nnpx codex-security scan /path/to/repo --fail-on-severity high\nnpx codex-security install-hook\nnpx codex-security bulk-scan\nnpx codex-security bulk-scan repositories.csv --output-dir /path/outside/repositories/security-scans\nnpx codex-security scans list /path/to/repo\nnpx codex-security scans list --scan-root /path/outside/repo/results\nnpx codex-security scans show SCAN_ID\nnpx codex-security scans rerun SCAN_ID\nnpx codex-security scans match PREVIOUS_SCAN_ID CURRENT_SCAN_ID\nnpx codex-security scans match --all\nnpx codex-security scans compare PREVIOUS_SCAN_ID CURRENT_SCAN_ID\nnpx codex-security export /path/outside/repo/results --export-format sarif --output /path/outside/repo/results.sarif\nnpx codex-security export /path/outside/repo/results --export-format csv --output /path/outside/repo/findings.csv\nnpx codex-security export /path/outside/repo/results --export-format json --output /path/outside/repo/findings.json\nnpx codex-security validate /path/outside/repo/findings.json \"Possible SQL injection in src/query.ts:42\"\nnpx codex-security patch /path/outside/repo/findings.json \"Missing authorization check in src/routes.ts:18\"\n```\n\n`install-hook`\n\nscans staged and unstaged changes before each commit. It respects\n`core.hooksPath`\n\n, does not replace an existing hook, and blocks high-severity\nfindings or failed scans. Set `--fail-on-severity`\n\nto change the threshold.\n\nUse `npx codex-security --version`\n\nfor the CLI version and\n`npx codex-security info --json`\n\nfor package, plugin, and runtime versions,\nthe default model and reasoning effort, and the next scan command. Add\n`--dry-run`\n\nto inspect the effective model and reasoning effort without\ninitializing Codex or contacting the network.\n\nThe output directory must be outside the scanned directory and any enclosing Git\nworktree. On macOS and Linux, an existing output directory must be private to\nthe current user (`chmod 700`\n\n). Scan artifacts can contain source excerpts,\nvulnerability details, and reproduction steps. Keep them out of repositories,\npublic issue reports, and shared locations.\n\nWhen SARIF is produced, it is written to\n`<scan-dir>/exports/results.sarif`\n\n. Use `npx codex-security scan --help`\n\nfor all\ntarget, output, and runtime options.\n\nRepeat `--knowledge-base PATH`\n\nfor multiple files or directories. Directories are\nsearched recursively for Markdown, text, PDF, and Word (`.docx`\n\n) files.\n\nSign in with `gh auth login`\n\n, then run `npx codex-security bulk-scan`\n\nto discover\nGitHub repositories pushed in the last 90 days. Archived\nrepositories and forks are excluded. Search the repository list, select the\nrepositories to scan, and confirm before scanning.\nPrivate checkouts reuse your GitHub CLI sign-in without changing your global Git\nconfiguration. For automation or an existing repository list, pass a CSV\ncontaining `id`\n\n, `repository`\n\n, and full immutable `revision`\n\ncolumns and specify\n`--output-dir`\n\n. Use `npx codex-security bulk-scan --help`\n\nfor all options.\n\nThe CLI uses [Incur](https://github.com/wevm/incur) for agent-friendly discovery\nand structured output. Use `--llms`\n\nfor the command manifest,\n`scan --schema --format json`\n\nfor a command schema, register an MCP server with\n`mcp add`\n\n, sync agent skills with `skills add`\n\n, and use\n`completions bash|zsh|fish`\n\nfor shell\ncompletions. Scan results support `--format toon|json|yaml|jsonl`\n\nand\n`--full-output`\n\n.\nUse `info --json`\n\nfor SDK and bundled-plugin metadata. MCP exposes only this\nread-only metadata command; scans, authentication, exports, validation, and\npatching remain CLI-only because the MCP transport cannot cancel active scans.\n\nIf the output directory already contains results, add `--archive-existing`\n\n.\nThe CLI moves them to `<output-dir>.previous-<timestamp>-<id>`\n\nand starts the\nscan in a new, empty directory at the original path. Add `--dry-run`\n\nto see\nthe destination without moving files.\n\nScans are report-only by default. Use `--fail-on-severity`\n\nin CI to exit 1 when\na completed scan contains a finding at or above the selected severity.\nIncomplete coverage and CLI/runtime errors exit 2. Incomplete scans still write\nthe available human or JSON result to stdout and a coverage warning to stderr,\nincluding in report-only mode.\n\nFor CI, save machine-readable output outside the checked-out repository and apply a severity policy. Incomplete coverage and runtime errors still exit nonzero:\n\n```\nSCAN_ROOT=\"$(mktemp -d)\"\nnpx codex-security scan . \\\n  --diff origin/main \\\n  --output-dir \"$SCAN_ROOT/results\" \\\n  --json \\\n  --fail-on-severity high > \"$SCAN_ROOT/findings.json\"\n```\n\nJSON scans remain noninteractive, including when stderr is a terminal. Commands\nthat run Codex interactively (`validate`\n\n, `patch`\n\n, `login`\n\n, and `logout`\n\n) reject\n`--json`\n\n. Write CSV exports to a file when JSON output is selected.\n\nScans use `gpt-5.6-sol`\n\nwith extra-high reasoning effort by default. Switch\nmodels with `--model`\n\n. Use `--codex`\n\nfor other Codex settings:\n\n```\nnpx codex-security scan . --model gpt-5.6-terra --codex 'model_reasoning_effort=\"high\"'\n```\n\nScans report their requested paths and actual ranking, file-review, validation, and attack-path phases. Completion shows finding severity, coverage, elapsed time, available token and worker counts, the results directory, and the next useful command. Progress remains on stderr; JSON results remain on stdout.\n\nCreate a client, choose a private output directory outside the repository, and close the client after the scan:\n\n``` js\nimport { CodexSecurity } from \"@openai/codex-security\";\n\nconst security = new CodexSecurity();\n\ntry {\n  const result = await security.run(\"/path/to/repository\", {\n    outputDir: \"/path/outside/repository/results\",\n  });\n\n  console.log(result.reportPath);\n  console.log(result.findings.findings.length);\n} finally {\n  await security.close();\n}\n```\n\nThe SDK also supports path and diff targets, preflight, progress callbacks, cancellation, security knowledge bases, and typed scan results.\n\nThe included Docker image runs noninteractive bulk scans from a supplied CSV on\na Linux Docker host. The included `compose.yaml`\n\nconfigures the image,\npersistent files, and a hardened Codex command sandbox.\n\n## Configure a Docker bulk scan\n\nCreate a `repositories.csv`\n\nwith one full, immutable Git commit per repository:\n\n```\nid,repository,revision\npayments,https://github.com/example/payments.git,0123456789abcdef0123456789abcdef01234567\n```\n\nCreate private, persistent result and authentication directories, and let the container write files as your current user:\n\n```\nmkdir -p results state\nchmod 700 results state\nexport CODEX_SECURITY_USER=\"$(id -u):$(id -g)\"\ndocker compose build codex-security\n```\n\nFor a one-time sign-in from a remote or headless Docker host, run:\n\n```\ndocker compose run --rm codex-security login --device-auth\n```\n\nOpen the displayed verification URL in your browser and enter the one-time\ncode. The login remains in `state/`\n\nafter the container exits.\n\nAlternatively, provide `OPENAI_API_KEY`\n\nor `CODEX_API_KEY`\n\nthrough your host\nenvironment or secret manager. For private repositories, provide `GH_TOKEN`\n\nor\n`GITHUB_TOKEN`\n\nthe same way. Compose passes only the named, configured\ncredentials to the container.\n\nStart a resumable, four-worker scan with the default command:\n\n```\ndocker compose run --rm codex-security\n```\n\nFull-repository scans can take tens of minutes per repository at the default extra-high reasoning setting. Run large campaigns as asynchronous batch jobs and keep the results and authentication directories mounted throughout the run.\n\nCompleted reports, per-repository findings, and the scan manifest appear in\n`results/`\n\non the host. The workbench state for that campaign remains in\n`results/.codex-security-state/`\n\n; the reusable Codex login remains separately in\n`state/`\n\n. This allows a new results directory to start a separate campaign with\nthe same login without colliding with an earlier scan. Rerun the same command\nwith the original CSV and the same `results/`\n\nand `state/`\n\ndirectories to resume\nan interrupted scan.\n\nTo choose a different number of parallel workers or retry failed repositories, override the default scan command:\n\n```\ndocker compose run --rm codex-security \\\n  bulk-scan /input/repositories.csv \\\n  --output-dir /output \\\n  --workers 8 \\\n  --max-attempts 2\n```\n\nSet `CODEX_SECURITY_CSV`\n\n, `CODEX_SECURITY_RESULTS`\n\n, or `CODEX_SECURITY_STATE`\n\nto use existing files or directories outside the Compose project. Set\n`CODEX_SECURITY_IMAGE`\n\nto use an approved, already-built image. Set\n`CODEX_SECURITY_GIT_HOST`\n\nwhen accessing GitHub Enterprise Server. Keep\ncredentials, repository lists, and results out of the image and Git; the\nincluded ignore files exclude them from image builds and commits.\nAll CSV files, including custom-named repository inventories, are excluded from\nthe Docker build context. Compose mounts the selected CSV at runtime instead.\n\nThe included Compose configuration drops all Linux capabilities, prevents new privileges, runs as a nonroot user, and applies the supplied default-deny seccomp profile. Codex Security runs each scan command in a separate unprivileged Linux sandbox. Docker's default seccomp profile blocks the user and mount namespaces required by that sandbox; the supplied profile permits only the needed namespace operations. The Linux host must allow unprivileged user namespaces. Some Docker Desktop virtual machines additionally restrict nested mount namespaces, so use a Linux host for production scans.\n\nFor environments without Docker Compose, the equivalent lower-level invocation is:\n\n```\ndocker run --rm --init \\\n  --user \"$(id -u):$(id -g)\" \\\n  --cap-drop ALL \\\n  --security-opt no-new-privileges \\\n  --security-opt \"seccomp=$PWD/docker/codex-security-seccomp.json\" \\\n  --env OPENAI_API_KEY \\\n  --env CODEX_API_KEY \\\n  --env GH_TOKEN \\\n  --env GITHUB_TOKEN \\\n  --env CODEX_SECURITY_GIT_HOST \\\n  --mount \"type=bind,source=$PWD/repositories.csv,target=/input/repositories.csv,readonly\" \\\n  --mount \"type=bind,source=$PWD/results,target=/output\" \\\n  --mount \"type=bind,source=$PWD/state,target=/state\" \\\n  codex-security:local \\\n  bulk-scan /input/repositories.csv \\\n  --output-dir /output\n```\n\nThe image configures a noninteractive Git credential helper for `github.com`\n\nwhen a GitHub token is supplied. The token works with both HTTPS repository\nURLs and `git@github.com:`\n\nrepository URLs without mounting an SSH agent. The\nimage never places that token in a repository URL, writes it to image layers,\nor sends it to another Git host. Set `CODEX_SECURITY_GIT_HOST`\n\nto the hostname\nof a GitHub Enterprise Server instance when needed.\n\nUse `--workers`\n\nto control concurrent repository scans and `--max-attempts`\n\nto\nretry failures. The command returns a nonzero status when any repository fails.\n\n`npx codex-security scans list`\n\nlists scans for the current repository. Pass a\nrepository path to inspect another checkout, `--scan-root DIR`\n\nto filter by\nscan artifact directory. `scans show SCAN_ID`\n\nincludes saved configuration,\nfindings, and coverage.\n\nHistory is saved in the existing Codex Security workbench database under\n`$CODEX_HOME/state/plugins/codex-security`\n\n. Set `CODEX_SECURITY_STATE_DIR`\n\nto\nchoose a different location.\n\n`scans rerun SCAN_ID`\n\nrepeats the same configuration against the current\ncheckout. `scans match BEFORE_SCAN_ID AFTER_SCAN_ID`\n\nlinks findings with the\nsame root cause; `scans match --all`\n\nincludes every available completed scan\nof the current repository, including other worktrees and clones. Use `--force`\n\nto recompute saved matches.\n\n`scans compare BEFORE_SCAN_ID AFTER_SCAN_ID`\n\nreads saved matches and identifies\nnew, persisting, reopened, resolved, or unknown findings. Missing findings remain\nunknown when coverage is incomplete or their original location was not reviewed.\n\nUse `export`\n\nto create CSV, JSON, or SARIF from a completed, sealed scan without\nstarting Codex or loading credentials. JSON preserves the sealed findings\ndocument. CSV uses the portable findings columns, marks findings as open, and\ndoes not include local workbench triage state. The exporter validates the seal\nbefore writing, accepts `--output -`\n\nfor stdout, and can use\n`--source-root /path/to/repo`\n\nwith SARIF to add source-line fingerprints. Run\n`npx codex-security export --help`\n\nfor all export options.\n\nUse `validate`\n\nto run the bundled validation skill on candidate findings and\n`patch`\n\nto run the bundled fix-finding skill on security issues. Each positional\ninput can be either a file, whose contents are read into the request, or literal\ntext. Both commands operate on the current directory.\n\nCanonical scan documents are limited to 16 MiB for the manifest, 128 MiB for findings, and 32 MiB for coverage. Oversized scans are rejected before sealing.\n\nExit codes are `0`\n\nfor a completed report-only scan or a passing policy, `1`\n\nfor a completed policy violation, `2`\n\nfor invalid input, incomplete coverage, or\na runtime/export error, `130`\n\nfor interruption, and `143`\n\nfor termination.\n\nUse `--dry-run`\n\nor `await security.preflight(...)`\n\nto validate local scan\ninputs and report the selected credential source without initializing Codex,\nloading credentials, or starting a scan. Dry runs do not inspect the plugin,\nprobe Python, or contact the network; their authentication metadata is not\nverified.\n\n[Codex Security overview](https://developers.openai.com/codex/security)[CLI quickstart and reference](https://developers.openai.com/codex/security/cli)[TypeScript SDK guide](https://developers.openai.com/codex/security/sdk)[GitHub issues](https://github.com/openai/codex-security/issues)for bugs and feature requests[Security policy](/openai/codex-security/blob/main/SECURITY.md)for private vulnerability reporting and safe operation[Contribution guidelines](/openai/codex-security/blob/main/CONTRIBUTING.md)\n\nThis project is licensed under the [Apache-2.0 License](/openai/codex-security/blob/main/LICENSE).", "url": "https://wpnews.pro/news/openai-just-open-sourced-codex-security", "canonical_source": "https://github.com/openai/codex-security", "published_at": "2026-07-28 20:52:55+00:00", "updated_at": "2026-07-28 21:23:14.525032+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools", "ai-products"], "entities": ["OpenAI", "Codex Security", "Node.js", "Python", "ChatGPT"], "alternates": {"html": "https://wpnews.pro/news/openai-just-open-sourced-codex-security", "markdown": "https://wpnews.pro/news/openai-just-open-sourced-codex-security.md", "text": "https://wpnews.pro/news/openai-just-open-sourced-codex-security.txt", "jsonld": "https://wpnews.pro/news/openai-just-open-sourced-codex-security.jsonld"}}