Codex Security
Codex Security helps you find, investigate, and fix vulnerabilities in your code.
Use its security workflows in Codex, or automate them with the
@openai/codex-security CLI and TypeScript SDK.
Features
- Scan repositories, selected paths, or Git changes. Deep scans repeat Standard scans and return their deduplicated findings.
- Validate candidate findings, generate patches, and verify existing fixes.
- Draft
SECURITY.md policies and save threat models for later review.
- Browse saved scans and findings, identify duplicates, assess severity against
your own rubric, and suggest owners from source and Git history.
- Preview third-party scanner findings, save them locally, or publish supported reports to Codex Security Cloud. Scanner import guides.
- Track findings in Linear, Jira, or GitHub, publish completed scans, or export SARIF, JSON, and CSV. Integration workflows.
- Automate scans across repositories or project components, including in CI and
containers.
Use in Codex
Open your repository in a Codex session with the Codex Security plugin enabled,
then ask:
Run a Codex Security scan on this repository, focusing on authentication and
authorization. Return the saved report, source evidence, and coverage limits.
A completed scan saves a report and findings. Read the report for source
evidence and exclusions, then request a patch or ask Codex to verify an
existing fix. See the agent workflow guide for setup,
task selection, and recovery.
Quick start
Requires Node.js 22.13.0+ within 22.x, or Node.js 24.x or 26.x, and Python 3.10+.
Python 3.10 also requires tomli.
Install the CLI globally and sign in:
npm install --global @openai/codex-security
cs login
Run your first scan from the repository directory:
cs scan .
When the scan completes, open the Markdown file at the REPORT path in the
terminal. Run cs scans show from the same repository to find its latest
completed scan again. See scan scope and follow-up work
for how to interpret exclusions in the report.
cs and codex-security run the same CLI. If the short name conflicts with
another command, use codex-security. To skip the global install, or if npm
reports an EEXIST conflict, use npx @openai/codex-security in place of
cs for both login and scanning.
For CI, set OPENAI_API_KEY or CODEX_API_KEY in the scan process's environment.
For a headless machine, see device or SSH login.
Scan options
Choose a scope and scan mode:
# Scan selected paths.
cs scan . --path src --path tests
# Scan committed changes from a base revision to HEAD.
cs scan . --diff origin/main
# Run a deep scan of the repository.
cs scan . --mode deep
Use cs scan . --max-time 15 for an advisory 15-minute Standard investigation
allowance. See investigation time
for timing semantics and Deep Scan limits.
Use cs --help to browse commands, or cs scan --help
for scan options, cost limits, and patching after a scan.
For an application spread across repositories, see
review one system across repositories.
Use bulk scans for independent repository
reviews in one resumable campaign.
Scans use existing root and component SECURITY.md guidance. To write or
revise it, see Generate SECURITY.md.
Some cybersecurity requests and protected findings require
Trusted Access for Cyber. For accounts with Daybreak
access, see Daybreak opt-in for the
Codex toggle and Cyber access programs
to select a program explicitly.
TypeScript SDK
Install the package locally in your TypeScript project:
npm install @openai/codex-security
Then import it:
import { CodexSecurity } from "@openai/codex-security";
const security = new CodexSecurity();
try {
const result = await security.run("/path/to/repository");
console.log(result.reportPath);
} finally {
await security.close();
}
The SDK guide includes deep-scan configuration,
validation, severity classification, owner suggestions, and result handling.
Linked Git worktrees share scan history and saved findings when they use the same
Codex Security state directory. Keep CODEX_SECURITY_STATE_DIR stable to retain
that shared history and sign-in scope. See the scan history guide.
Read existing Cloud findings
When Codex Security Cloud is available to your account, the Security plugin's
$cloud-findings skill can read findings, reports, recorded assignment and
verification, and scan status in Codex desktop or the Codex CLI. Cloud is an
optional connection; local scans work without it.
See Cloud connection setup and CLI reads
for authentication requirements and a read-only example.
Generate SECURITY.md
Use policy to draft a new SECURITY.md or update an existing one. Use --path
to select a component:
cs policy .
cs policy . --path services/api --knowledge-base architecture.md
This is the beginning of the README. Read the rest at the original. Read the full README ↗
