OpenAI introduces Codex Security, an open-source command-line interface (CLI) and TypeScript SDK designed to help developers detect, validate, and remediate security vulnerabilities directly within their codebases This article explores openai codex security. . The tool, published as @openai/codex-security, extends OpenAI's Codex ecosystem into the application security space, offering automated repository scanning, change review, and continuous integration (CI) support.
It allows teams to scan entire repositories for vulnerabilities, review code changes for newly introduced risks, and track findings over time rather than treating each scan as an isolated event. OpenAI's Codex Security CLI offers persistent tracking capability, distinguishing it from many standalone static analysis tools, which build a historical record of vulnerability status across a codebase’s lifecycle.
Installation involves using npm to install the package, logging into the system via CLI, and executing a scan against target directories; for CI environments, authentication uses the OPENAI_API_KEY environment variable instead of requiring an interactive login. When both ChatGPT sign-in credentials and API keys are available, interactive scans prompt users to select which credential to use, while non-interactive and CI scans automatically default to using the API key for precedence. If this location lacks write permissions, recommend setting up storage using the `CODEX_SECURITY_STATE_DIR` environment variable, pointing it to a writable path outside of the repository, particularly useful for containerized or restricted-permission CI runners.
