Codex Security
A CLI and TypeScript SDK from OpenAI for defining security policy and finding, validating and fixing vulnerabilities in code, with containerized bulk scanning and a findings service.
Codex Security is a command-line tool and TypeScript SDK for defining security policy and for finding, validating and fixing vulnerabilities in a codebase. It can scan a local directory after signing in, or by using an API key for use in CI.
It can draft a repository-wide or component-scoped SECURITY.md policy document from a codebase, saving the draft outside the checkout for review before it is copied in. The TypeScript SDK exposes the same scanner programmatically, with configurable scan mode, worker count, subagent count and time limits, and can suggest owners for existing findings from source code and Git history.
A Docker Compose configuration supports scanning many repositories in bulk, and a preview findings service can run scans with durable state, either through Docker or directly from the same container image. It requires Node.js 22.13 or later and Python 3.10 or later, and is written in TypeScript under the Apache-2.0 license.