# OpenAI Codex Security — Apache-2.0 CLI scans repos for vulnerabilities

> OpenAI's new Apache-2.0 tool for finding, tracking, and gating security bugs in a codebase, from the command line or inside CI.

- Org: OpenAI
- Date: 2026-07-28
- Category: tool, security, repo
- Source: https://github.com/openai/codex-security
- Canonical page: https://ai-tldr.dev/releases/openai-codex-security/

## In short

OpenAI open-sourced Codex Security, an Apache-2.0 CLI and TypeScript SDK that scans repositories, reviews pull-request changes, tracks findings over time, and plugs into CI as a security gate.

## What it is

Codex Security is a CLI and TypeScript SDK from OpenAI, released as `@openai/codex-security` on npm under Apache-2.0. The tool scans a repository, reviews the diff on a change, keeps a record of findings, and can block a CI job when new vulnerabilities appear.

## How it works

Codex Security runs as a Node.js CLI (`npx codex-security scan .`) backed by the Codex Security service. Developers authenticate once with `codex-security login`; in CI the tool reads `OPENAI_API_KEY` instead. Scans compare the current tree against tracked findings so the same issue does not re-alert once triaged.

## Why it matters

OpenAI Codex Security drops a first-party security scanner into the same repos that already use Codex for coding, and hands teams an Apache-2.0 SDK they can wrap into their own review flows. Because the CLI is TypeScript with a matching SDK, teams can call it from an existing Node review bot, a GitHub Action, or a pre-commit hook without a new agent framework.

## Who it's for

Security-conscious engineering teams, platform engineers wiring CI, Codex users

## Try it

npm install -g @openai/codex-security && npx codex-security scan .

## Quick facts

- Maker: OpenAI
- Released: 2026-07-28 (repo made public)
- License: Apache-2.0
- Package: @openai/codex-security (npm)
- Runs: Node.js 22+, Python 3.10+
- Auth: Interactive login or OPENAI_API_KEY
- Surfaces: CLI, TypeScript SDK, CI hook

## FAQ

### Is OpenAI Codex Security free to use?

The Codex Security CLI and TypeScript SDK are open source under Apache-2.0 on GitHub, but the scanner is a client for the Codex Security service and needs authorized access. Developers log in interactively for local use, and CI jobs read `OPENAI_API_KEY` from the environment. OpenAI has not yet published a separate price list for the backend service.

### How do I run OpenAI Codex Security in CI?

Install `@openai/codex-security` from npm on a Node.js 22 runner, set `OPENAI_API_KEY` as a secret, and call `npx codex-security scan .` in the workflow. Codex Security tracks findings between runs, so the pipeline can fail only when a new vulnerability appears in the change, not when a known issue is still open.

### What does OpenAI Codex Security actually scan for?

The README describes Codex Security as a tool to find, validate, and address security vulnerabilities across a codebase, and lists repo-wide scans, per-change diff review, and finding history as core features. OpenAI has not published the full vulnerability class list on the repo; the public docs are the source of truth for the backing service.

## Links

- [GitHub Repo](https://github.com/openai/codex-security)
- [README](https://github.com/openai/codex-security/blob/main/README.md)