OpenAI Open-Sources Codex Security: AI-Powered Code Vulnerability Scanner
Key Takeaways
- ▸OpenAI open-sources Codex Security, an AI-powered code security analysis tool available via npm with CLI and TypeScript SDK support
- ▸Supports cross-platform development (macOS, Linux, Windows) with Node.js 22+ requirement and optional Python 3.10+ for advanced scanning and export features
- ▸Includes enterprise-grade capabilities: bulk scanning, CI/CD integration, git hooks, custom threat models, severity filtering, and multiple export formats (SARIF, CSV, JSON)
Summary
OpenAI has released Codex Security as an open-source CLI and TypeScript SDK, bringing AI-powered code vulnerability detection to developers. The tool leverages OpenAI's models to find, validate, and review security issues in codebases, with support for cross-platform development (macOS, Linux, Windows) and integration into CI/CD pipelines. Codex Security requires Node.js 22 or later and optional Python 3.10+ for scanning and export functionality, authenticating via OpenAI API keys or ChatGPT accounts.
The release includes comprehensive features such as severity-based filtering, git diff scanning, bulk repository scanning, custom threat model integration, and multiple export formats (SARIF, CSV, JSON) for seamless security toolchain integration. Developers can install the tool via npm and begin scanning with just a few commands, with additional capabilities like git hook installation for pre-commit security validation and scan result comparison across multiple runs.
- Requires OpenAI API authentication or ChatGPT sign-in; follows semantic versioning with public API stability guaranteed after version 1.0.0
