By July 29, OpenAI had published Codex Security as an Apache-2.0 command-line interface and TypeScript SDK for finding, validating, and fixing code vulnerabilities. GitHub metadata dates the public repository to July 13, while OpenAI's current documentation describes beta access, repository and change scans, finding history, CI checks, and safeguards for reports that can contain source excerpts and vulnerability details.
OpenAI has published Codex Security under the Apache-2.0 license, exposing a command-line interface and TypeScript SDK for scanning code repositories, validating vulnerabilities, and producing remediation-oriented findings. The OpenAI-owned GitHub repository was created on July 13 and remained active on July 29, so the release should not be described as having first occurred on July 29.
OpenAI's CLI documentation says the CLI and SDK are in beta and require access. The tool can run interactively through a ChatGPT sign-in or noninteractively in CI using an OpenAI API key. The documentation also notes that credentials alone may not grant permission for full-repository scans, depending on the account and repository.
CLI and SDK workflow
The published quick start installs @openai/codex-security, authenticates with npx codex-security login, and runs npx codex-security scan .. The TypeScript SDK exposes a CodexSecurity client whose run() method accepts a repository path and returns a result containing a report path.
OpenAI documents these workflow elements:
- •Repository scans and targeted review of paths or changes.
- •Persistent scan history and structured output for downstream processing.
- •CI use through OPENAI_API_KEY instead of interactive authentication.
- •A --dry-run mode that validates local inputs without starting Codex or credentials.
The CLI requires Node.js 22 or later. Running scans or exporting findings also requires Python 3.10 or later. Results are stored in a persistent state directory unless users specify --output-dir.
Handling sensitive scan output
OpenAI cautions that scan results can contain source excerpts and vulnerability details. Its documentation recommends storing output outside the repository, in a private location, with an appropriate retention policy. That matters in build pipelines, where logs and exported findings can otherwise reach broad internal audiences.
The repository and official CLI documentation are the direct sources for the CLI and SDK. The separate Codex Security plugin setup page describes an interactive plugin workflow rather than the open-source CLI and SDK release, so it is not the originating source for this event.
For security engineering teams, the release supplies an automation surface beyond an interactive coding assistant: a command-line scanner for local repositories and CI, plus a programmatic TypeScript interface. Teams evaluating it should test access requirements, scan reproducibility, credential isolation, and the handling and retention of generated vulnerability reports.
Key Points #
- 1OpenAI published Codex Security as an Apache-2.0 CLI and TypeScript SDK for repository scanning, vulnerability validation, remediation workflows, and CI checks.
- 2GitHub metadata dates the repository to July 13, while OpenAI's current beta documentation describes ChatGPT authentication locally and API-key authentication in CI.
- 3OpenAI warns that scan output can include source excerpts and vulnerability details, so teams should keep reports private and set an appropriate retention policy.
Scoring Rationale #
Codex Security provides an open-source interface for vulnerability scanning and CI workflows. It is directly relevant to application-security and developer-platform teams, although the beta access requirement limits immediate availability.
Sources #
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.