OpenAI's Codex Security CLI scans repos for vulnerabilities and fixes them
A new CLI from OpenAI that automatically finds, validates, and patches security flaws in code.
OpenAI has launched Codex Security, a developer tool designed to automate security vulnerability detection and remediation. Available as a CLI and a TypeScript SDK, it integrates directly into your development workflow — scanning entire repositories, reviewing pull request changes, and tracking findings over time. The tool supports both interactive and CI environments, allowing teams to enforce security checks without manual gatekeeping.
Installation requires Node.js 22+, Python 3.10+, and a Codex Security account. Users can authenticate via a ChatGPT sign-in or an API key (for CI). The CLI offers flexible credential selection: set OPENAI_API_KEY for noninteractive scans, or use --auth chatgpt/--auth api-key for explicit control. Scan history is stored locally in the Codex Security workbench state directory, configurable via CODEX_SECURITY_STATE_DIR. The TypeScript SDK enables programmatic usage with methods like .run() and .close(), making it easy to embed security checks into custom tooling.
- npm install @openai/codex-security, then npx codex-security scan . to scan a repository for vulnerabilities
- Supports both ChatGPT sign-in and API key authentication; CI scans default to API key
- Includes TypeScript SDK for custom integrations: new CodexSecurity().run('.') returns a report path
Why It Matters
Automates security auditing in CI pipelines, reducing manual review time and catching vulnerabilities before deployment.