Repolode
Submit
openai

openai/codex-security

A CLI and TypeScript SDK from OpenAI for scanning code for security vulnerabilities, validating findings, and generating fixes.

Open-source alternative to:Snyk CodeGitHub Advanced SecurityVeracode

View on GitHubWebsite
Stars
11,128
Forks
940
Open issues
227
Last commit
12 hours ago

What is it?

Codex Security is a command-line tool and TypeScript SDK for finding security vulnerabilities in a codebase. It can scan a full repository, selected paths, or only the changes in a Git diff, and deep scans run parallel discovery workers. Candidate findings can be validated, patches generated, and existing fixes re-checked.

Beyond scanning, it helps with the surrounding security workflow. It can draft a SECURITY.md policy, save threat models, deduplicate findings, rate severity against a custom rubric, and suggest code owners from source and Git history. Results can be exported as SARIF, JSON, or CSV, and GitHub code scanning alerts can be imported.

Scans run against OpenAI, Amazon Bedrock, OpenRouter, or Fireworks AI, and can be automated in CI through a GitHub Action or in containers. Requires Node.js 22.13+ or 24/26 and Python 3.10+.

Key features

  • 01Scans full repositories, selected paths, or Git diffs with optional deep scan mode.
  • 02Validates candidate findings, generates patches, and verifies existing fixes.
  • 03Drafts SECURITY.md policies and saves threat models for review.
  • 04Deduplicates findings and suggests owners from source and Git history.
  • 05Imports GitHub code scanning alerts and exports SARIF, JSON, or CSV.

Use cases

  • Running periodic security scans of a repository through a scheduled GitHub Actions workflow.
  • Reviewing only the security impact of a pull request or set of committed changes.
  • Embedding vulnerability scanning in a TypeScript tool or internal platform via the SDK.
  • Scanning many repositories in a resumable batch, such as inside containers.

Topics

#security#vulnerability-scanning#code-scanning#appsec#cli#typescript#devsecops#ai-security#application-security#codex

FAQ

What is codex-security?
A CLI and TypeScript SDK from OpenAI for scanning code for security vulnerabilities, validating findings, and generating fixes. Codex Security is a command-line tool and TypeScript SDK for finding security vulnerabilities in a codebase. It can scan a full repository, selected paths, or only the changes in a Git diff, and deep scans run parallel discovery workers. Candidate findings can be validated, patches generated, and existing fixes re-checked.
Is codex-security free to use? What license does it have?
codex-security is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is codex-security still maintained?
Actively maintained. The last commit to codex-security was on Oct 18, 2026.
What can I use codex-security for?
Running periodic security scans of a repository through a scheduled GitHub Actions workflow. Reviewing only the security impact of a pull request or set of committed changes. Embedding vulnerability scanning in a TypeScript tool or internal platform via the SDK. Scanning many repositories in a resumable batch, such as inside containers.
Where can I get codex-security?
The source code and installation instructions are on GitHub: https://github.com/openai/codex-security

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects