Repolode
Предложить
openai

openai/codex-security

A CLI and TypeScript SDK from OpenAI for scanning code for security vulnerabilities, validating findings, and generating fixes.

Открыть на GitHubСайт
Звёзды
11,135
Форки
962
Открытые issues
229
Последний коммит
3 часа назад

Что это?

Codex Security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in source code. It can scan a whole repository, selected paths, or only Git changes, with a deep mode that runs parallel discovery workers. Candidate findings can be validated, patches generated, and existing fixes re-verified.

Beyond scanning, it helps manage results: it drafts a SECURITY.md policy, saves threat models, deduplicates findings, assigns severity against a custom rubric, and suggests owners from source and Git history. Results can be imported from GitHub code scanning alerts and exported as SARIF, JSON, or CSV, or published to Linear or a findings service.

It runs locally with Node.js 22.13+ or 24/26 and Python 3.10+, can be used in GitHub Actions, CI, and containers, and supports OpenAI, Amazon Bedrock, OpenRouter, Fireworks AI, and Cheaper Inference as model providers.

Ключевые возможности

  • 01Scans repositories, selected paths, or Git diffs, with a deep mode using parallel workers.
  • 02Validates candidate findings, generates patches, and verifies existing fixes.
  • 03Drafts SECURITY.md policies and saves threat models.
  • 04Deduplicates findings and assesses severity against a custom rubric.
  • 05Imports GitHub code scanning alerts and exports SARIF, JSON, or CSV.
  • 06Runs in GitHub Actions, CI, and containers.

Сценарии использования

  • Running scheduled or pull request security scans in GitHub Actions.
  • Reviewing only the changes in a branch before merging.
  • Scanning multiple repositories in a resumable bulk campaign.
  • Exporting SARIF results to feed existing code scanning dashboards.

Темы

#ai-security#application-security#vulnerability-scanning#code-scanning#devsecops#typescript#cli#sdk#codex#codex-security

Частые вопросы

Что такое codex-security?
A CLI and TypeScript SDK from OpenAI for scanning code for security vulnerabilities, validating findings, and generating fixes. Codex Security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in source code. It can scan a whole repository, selected paths, or only Git changes, with a deep mode that runs parallel discovery workers. Candidate findings can be validated, patches generated, and existing fixes re-verified.
codex-security можно использовать бесплатно? Какая у него лицензия?
codex-security распространяется с открытым исходным кодом под лицензией Apache-2.0. Перед использованием в коммерческих продуктах проверьте условия лицензии.
codex-security всё ещё поддерживается?
Активно поддерживается. Последний коммит в codex-security — 19 окт. 2026 г..
Для чего можно использовать codex-security?
Running scheduled or pull request security scans in GitHub Actions. Reviewing only the changes in a branch before merging. Scanning multiple repositories in a resumable bulk campaign. Exporting SARIF results to feed existing code scanning dashboards.
Где скачать codex-security?
Исходный код и инструкции по установке — на GitHub: https://github.com/openai/codex-security

Описание создано ИИ на основе README проекта. Статистика GitHub обновляется ежедневно.

Похожие проекты