OpenAI Releases Codex Security CLI Tool and TypeScript SDK for Repository Audits
OpenAI released `@openai/codex-security`, a command-line tool and TypeScript SDK designed to scan codebases, track security findings, and integrate automated security reviews into Continuous Integration pipelines.
Impact: Medium
Why it matters
You can now embed automated OpenAI-powered code vulnerability scanning into local terminal workflows and continuous integration environments.
TL;DR
- 01OpenAI releases @openai/codex-security for CLI and programmatic security scanning.
- 02Requires Node.js 22+ and Python 3.10+ environments.
- 03Supports both interactive ChatGPT logins and automated CI API keys.
Key facts
- NPM Package
- @openai/codex-security
- Minimum Node.js Version
- v22.0.0
- Minimum Python Version
- v3.10.0
Running Repository Scans via CLI
Execute scans using Node.js 22+ and Python 3.10+. Select explicit authentication sources based on execution context:
# Interactive execution with ChatGPT authentication
npx codex-security scan . --auth chatgpt
# CI execution with API key
export OPENAI_API_KEY="your-api-key"
npx codex-security scan . --auth api-keyProgrammatic Usage with TypeScript SDK
Import and run scans within custom developer tools or build scripts:
import { CodexSecurity } from "@openai/codex-security";
const security = new CodexSecurity();
const result = await security.run(".");State storage paths can be customized by setting CODEX_SECURITY_STATE_DIR to ensure write permissions inside restricted CI containers.
Try it in 2 minutes
import { CodexSecurity } from "@openai/codex-security";
const security = new CodexSecurity();
const result = await security.run(".");typescript
✓ When to use
- Use to perform automated vulnerability checks and security reviews on pull requests and local branches.
✕ When NOT to use
- Do not run in public CI pipelines without isolating or restricting access to the underlying API keys.
What to do today
- Run npx @openai/codex-security scan . on your core repository to evaluate baseline security output.
- Add OPENAI_API_KEY to your GitHub Actions secrets to enable automated CI scan steps.
What the community says
“It's cool but must be very annoying to use without being allowed into the cybersecurity program.”
Sources