Security Scans, Patches, and Reports, All From Your Terminal

You know the drill: a security scanner flags something, you open a ticket, someone triages it, and eventually a patch lands—usually after a few rounds of "is this actually a real issue?" Codex Security is an attempt to collapse that loop into something you can run yourself, whether you're sitting in a terminal or working inside a Codex session.

What It Does

Codex Security helps you find, investigate, and fix vulnerabilities in your code. It comes in a few shapes depending on how you work. Inside Codex, you enable the plugin and pick a security workflow. In a terminal, you install the @openai/codex-security CLI and scan from the command line. And for automation, there's a TypeScript SDK and a GitHub Action.

The CLI is invoked as cs (or codex-security if the short name collides with something else on your machine). You point it at a repository, a set of paths, or a Git diff, and it produces a report. A completed scan saves a report and findings to disk, and you can pull up your latest completed scan later with cs scans show. It requires Node.js 22.13.0+ (within 22.x) or Node.js 24.x or 26.x, plus Python 3.10+ (which needs tomli on 3.10 specifically).

Beyond scanning, it validates candidate findings, generates patches, and verifies existing fixes. It can also draft SECURITY.md policies and save threat models for later review.

Why It's Cool

The scan scopes are genuinely practical. You're not stuck with all-or-nothing. Scan selected paths with --path src --path tests, scan committed changes from a base revision with --diff origin/main, or run a deep scan with --mode deep. That last one is interesting: deep scans repeat standard scans and return deduplicated findings, which suggests the tool is designed to be run more than once without drowning you in repeats.

It goes past detection into remediation. Plenty of tools tell you something might be wrong. This one validates candidate findings, generates patches, and can verify whether an existing fix actually holds up. That's the part of security work that usually eats the most time, and it's built into the workflow rather than bolted on.

The reporting is designed for triage, not just output. You can browse saved scans and findings, identify duplicates, assess severity against your own rubric, and suggest owners based on source and Git history. That owner-suggestion detail is a nice touch—it acknowledges that a finding is useless if nobody knows who should fix it.

It plays well with the tools you already use. Findings can be tracked in Linear, Jira, or GitHub, and completed scans can be exported as SARIF, JSON, or CSV. There's also support for previewing third-party scanner findings, saving them locally, or publishing supported reports to Codex Security Cloud. If you've got an existing scanner in your stack, this doesn't pretend it doesn't exist.

Automation isn't an afterthought. For CI, you set OPENAI_API_KEY or CODEX_API_KEY in the scan process environment. There's also support for bulk scans across independent repositories in one resumable campaign, and for reviewing one system spread across multiple repositories.

Timing is advisory and explicit. cs scan . --max-time 15 gives a 15-minute Standard investigation allowance. The README is careful to call it an advisory allowance with documented timing semantics, which is a refreshingly honest way to frame a time budget.

How to Try It

1. Make sure you've got the prerequisites: Node.js 22.13.0+ (within 22.x) or Node.js 24.x or 26.x, and Python 3.10+ (with tomli if you're on 3.10).

2. Install the CLI globally and sign in:

npm install --global @openai/codex-security
cs login

1. From your repository directory, run your first scan:

cs scan .

1. When it finishes, open the Markdown file at the REPORT path printed in your terminal. You can find that latest completed scan again with cs scans show.

If you'd rather skip the global install—or npm throws an EEXIST conflict—use npx @openai/codex-security in place of cs for both login and scanning.

From there, try the scoping options:

cs scan . --path src --path tests
cs scan . --diff origin/main
cs scan . --mode deep

Run cs --help to browse commands, or cs scan --help for scan options, cost limits, and patching after a scan. The repo is at github.com/openai/codex-security.

Final Thoughts

Codex Security is aimed at teams that want security review to live closer to where the code does—in the terminal, in CI, and in the agent session you're already using. The combination of scanning, validation, patching, and verification in one workflow is the real draw, and the integrations (Linear, Jira, GitHub, SARIF export, third-party scanner imports) suggest it's meant to slot into existing processes rather than replace them. If you've been looking for a way to make security checks a routine part of your development loop instead of a periodic fire drill, this is worth a look.

Follow @githubprojects for more developer tools and open source projects.