openai/codex-security
★ 11,136 stars
Covered in week 2026-W37 · the 2026-09 report
OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security
What codex-security is
The findings service runs from the same ghcr.io/openai/codex-security image as the scanner (or a local source build), with a separate container and state volume configured by compose.findings.yaml. It stores findings and embeddings in SQLite and lists findings with pagination. Its read-only dashboard at /dashboard refreshes every five seconds and shows stored findings and duplicate groups from the service's database.
From the repository README · read it on GitHub →
Transcript
Vulnerability reports pile up faster than anyone can triage. OpenAI's codex-security CLI and TypeScript SDK find, validate, and fix them in your code. Scan any directory, run bulk scans across many repositories through Docker Compose, wire it into CI with an API key. Some protected findings require Trusted Access for Cyber approval, yet the rest ship already fixed.