Twitter/X

OpenAI open-sourced codex-security (Apache 2.0, limited beta) — a CLI and…

2026-07-30 · 03:59 UTC ·@DataChaz ·1 min read

Brief

OpenAI's codex-security is an open-source (Apache 2.0) CLI and TypeScript SDK in limited beta that finds, validates, ranks, and helps remediate code vulnerabilities. Each scan yields evidence, exact locations, proposed patches, and a coverage status, and can run locally, as a pre-commit gate, or in CI; Node.js 22+ or Python 3.10+ are required.

Why it matters

OpenAI open-sourced codex-security (Apache 2.0, limited beta) — a CLI and TypeScript SDK announced by @DataChaz on 2026-07-30 that finds, validates, ranks (by severity and confidence), and helps fix code vulnerabilities.

Key details

  • Scans provide evidence with exact locations, generate remediation guidance and proposed patches, and track issues as new, persisting, reopened, or resolved while reporting coverage status (complete/partial/unknown).
  • Runs locally, as a pre-commit check, or in CI; requires Node.js 22+ or Python 3.10+; model-based scans consume tokens and can be budgeted with --max-cost; CLI available via npx @openai/codex-security@latest.
Source evidence

OPENAI JUST OPEN-SOURCED CODEX SECURITY 🔥

It’s a CLI and TypeScript SDK that finds, validates, tracks, and helps fix security vulnerabilities in your code.

Point it at a repo and it can:

→ Find vulnerabilities, ranked by severity and confidence
→ Validate findings with evidence and exact locations
→ Generate remediation guidance and proposed patches
→ Track issues as new, persisting, reopened, or resolved

You can run it locally, install a pre-commit check that blocks high-severity findings, or add it to CI with your own severity threshold.

A particularly useful detail: every scan reports whether its coverage was complete, partial, or unknown, including anything it skipped.

Since model-based scans consume tokens, --max-cost also gives teams a practical budget guardrail for each run.

It’s open-source under Apache 2.0 and currently in limited beta, so access is still required.

Node.js 22+ and Python 3.10+.

Try it:

npx @openai/codex-security@latest --help

Repo + docs below ↓