# openai/codex-security

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security

Repository: https://github.com/openai/codex-security
Canonical: https://ross.abutalabs.com/products/codex-security
Homepage: https://developers.openai.com/codex/security
Language: TypeScript
License: Apache-2.0
License Family: permissive
Topics: ai-security, application-security, cli, code-scanning, codex, codex-security, cybersecurity, devsecops, nodejs, npm, openai, sdk, security, typescript, vulnerability-scanning
Last push: 2026-08-27T00:06:30+00:00

## Health v2 (maintenance only)
Score: 80/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 99, longevity 3
- inputs: {"age_days": 51, "days_push": 7, "days_rel": 8, "gap_med": 0.0, "n_releases_24m": 21}
- flags: young
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 10202, forks 730 (observed 2026-08-28T04:10:39.849919+00:00)

## What it is
OpenAI's Codex Security is a CLI and TypeScript SDK that uses AI to find, validate, and fix security vulnerabilities in codebases. It supports multiple inference providers (OpenAI, Amazon Bedrock, OpenRouter, Fireworks) and containerized bulk scans of many repositories.

## Use cases
- scan a codebase for security vulnerabilities
- find and fix security issues in my code with AI
- run automated security scans in CI
- bulk scan many repositories for vulnerabilities
- integrate AI-powered security scanning into a Node.js app
- use a non-OpenAI LLM provider for security scanning

## When to choose
- you want AI-driven discovery, validation, and fixing of vulnerabilities beyond static rule-based scanners
- you need a CLI for local or CI security scans with an npm SDK for programmatic use
- you want to scan many repos at scale via Docker Compose
- you want flexibility to swap LLM providers (Bedrock, OpenRouter, Fireworks)

## When to avoid
- you need fully offline scanning without any LLM API access or API keys
- you only need lightweight traditional SAST/dependency auditing without AI inference costs
- your environment cannot run Node.js 22.13+ and Python 3.10+
- you require fully deterministic, auditable scanning results without model-driven variability

## Facets
- artifact type: cli-tool
- maturity: active
- function: vulnerability-scanning, security, cli, sdk, agent-framework
- domain: security, developer-tools, artificial-intelligence
- platform: cli, cross-platform
- tags: ai-security, code-scanning, devsecops, application-security, typescript-sdk, openai, cybersecurity, command-line, nodejs, docker

## Member repositories
- openai/codex-security (main) score 80

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:39.849919+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:19:36.025130+00:00, confidence not recorded.
  - readme: https://github.com/openai/codex-security (fetched 2026-08-28T04:10:39.849919+00:00, sha 7de8e0d9efe6)
  - homepage: https://developers.openai.com/codex/security (fetched 2026-08-29T08:19:32.435162+00:00, sha 2799b9a584b9)
  - site_page: https://learn.chatgpt.com/api/docs (fetched 2026-08-29T08:19:32.445596+00:00, sha 7c75d2c4ef28)
  - site_page: https://learn.chatgpt.com/docs (fetched 2026-08-29T08:19:32.449034+00:00, sha e43ed4c75a43)
  - site_page: https://learn.chatgpt.com/codex/features (fetched 2026-08-29T08:19:32.455479+00:00, sha 9b0e57b4407c)
  - site_page: https://learn.chatgpt.com/api/docs/quickstart (fetched 2026-08-29T08:19:32.457538+00:00, sha 8f592486a220)
  - site_page: https://learn.chatgpt.com/api/docs/guides/latest-model (fetched 2026-08-29T08:19:32.459804+00:00, sha 019d1289b7da)
  - site_page: https://learn.chatgpt.com/api/docs/concepts (fetched 2026-08-29T08:19:32.462215+00:00, sha ccdddf3fa247)
  - site_page: https://learn.chatgpt.com/codex (fetched 2026-08-29T08:19:32.451226+00:00, sha 54ab8ad10fb3)
  - site_page: https://learn.chatgpt.com/learn (fetched 2026-08-29T08:19:32.453338+00:00, sha caed4ecaebe4)
- Data as of 2026-08-30T08:39:29.467469+00:00.