OpenAI Ships Codex Security as a Public CLI and TypeScript SDK for Scanning, Validating and Fixing Vulnerabilities in CI
The openai/codex-security repo, now at 3,732 stars with commits as recent as July 29, packages @openai/codex-security as a CLI plus TypeScript SDK that scans repositories, reviews changes, tracks findings over time and runs security checks in CI, requiring Node 22+ and Python 3.10+. It authenticates either through ChatGPT sign-in or OPENAI_API_KEY, with API-key precedence preserved for noninteractive CI runs and an explicit --auth chatgpt or --auth api-key selector, and stores scan history in a workbench state directory redirectable via CODEX_SECURITY_STATE_DIR. Landing the same week the industry is absorbing an agent-driven intrusion at Hugging Face, this is OpenAI positioning Codex on the defensive side of the same capability, and the ChatGPT-subscription auth path matters for anyone who does not want a metered API key in their pipeline.
↳ Follow the thread