codex-security
OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security
What is it?
What it is
@openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in code.
Why it exists
To enable developers to scan their projects for security issues, validate findings, and apply fixes using Codex-powered analysis, integrating security into development and CI workflows.
Who should use it
DevSecOps engineersSecurity researchersSoftware developersApplication security engineersCI/CD pipeline administrators
Who should avoid it
Users without Node.js 22.13.0+ or Python 3.10+Users without access to Codex SecurityUsers unable to provide API keys or ChatGPT credentials
How it works
A quick walkthrough in plain English
How codex-security works
Step 1 of 3
You interact with it
Open codex-security, send a request, or connect it to your stack.
Features
Advantages
- Automates identification of new, persisting, reopened, or resolved findings
- Flexible authentication for both interactive and non-interactive environments
- High-effort scanning modes available
- Seamless integration into DevSecOps workflows
- Maintains persistent state for scan history and credential management
Disadvantages
- Requires specific Node.js versions (22.x, 24.x, or 26.x)
- Requires Python 3.10 or later
- Requires access to Codex Security and potentially Trusted Access verification
- Scan comparison accuracy depends on complete coverage and original location review
Installation
native
npm install @openai/codex-security
FAQ
What are the system requirements to run Codex Security?
You need Node.js 22.13.0+ (in the 22.x line), Node.js 24.x, or Node.js 26.x, and Python 3.10 or later. You also require access to Codex Security.
How can I use Codex Security in a CI/CD pipeline?
For non-interactive CI environments, set the `OPENAI_API_KEY` or `CODEX_API_KEY` environment variables. This avoids the need for interactive login and ensures keys are passed directly to the scan without being stored in the system keyring.
How do I compare results between two different scans?
Use the command `npx @openai/codex-security scans compare BEFORE_SCAN_ID AFTER_SCAN_ID`. This will match findings by root cause and identify if vulnerabilities are new, persisting, reopened, resolved, or unknown.
How can I change where scan history is stored?
If the default Codex Security workbench state directory is not writable, you can set the `CODEX_SECURITY_STATE_DIR` environment variable to a writable directory outside of your repository.
Can I choose which authentication method to use for a scan?
Yes. You can explicitly select your authentication method using the `--auth` flag, such as `npx @openai/codex-security scan. --auth chatgpt` or `npx @openai/codex-security scan. --auth api-key`.
Featured in Videos
YouTube tutorials and walkthroughs for codex-security
Alternatives
Similar projects ranked by category, topics, and text overlap.
