OpenAI quietly pushed Codex Security to GitHub and npm before it had a chance to announce it , Hacker News found the repo first. The tool is a CLI and TypeScript SDK that uses OpenAI's reasoning models to scan codebases for security vulnerabilities, validate findings in a sandbox, and plug into CI/CD pipelines. It is open source under Apache-2.0 and available right now.
What it actually does
Codex Security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code. It lets you scan repositories, review changes, track findings over time, and run security checks in CI. That last part is the key differentiator from a one-shot scan: the tool is built around persistence across runs.
The scan pipeline works in three stages:
- It analyzes a repository to understand the project's security-relevant structure and generates an editable threat model that captures what the system does and where it is most exposed.
- Once the system context is built, Codex Security uses it as a foundation to identify vulnerabilities and classifies findings based on their real-world impact.
- The flagged issues are pressure-tested in a sandboxed environment to validate them. When configured with an environment tailored to your project, it can validate potential issues directly in the context of the running system.
By default, scans use gpt-5.6-sol with extra-high reasoning effort. You can switch to gpt-5.6-terra for a cheaper run. The SDK and CLI support macOS, Linux, and Windows and require Node.js 22 or later. Scanning and exporting findings also require Python 3.10 or later.