---
id: 7527
canonical_url: "https://phying.com/item/7527"
title: "OpenAI Codex Security: Automated Vulnerability Discovery, Validation, and Remediation CLI & SDK"
type: "tool"
cve: null
cvss: null
severity: "unknown"
vendor: "OpenAI"
product: "Codex Security"
affected_versions: null
source_domain: "github.com"
source_url: "https://github.com/openai/codex-security"
published_at: "2026-08-28T13:51:50Z"
snapshot_at: "2026-10-26T06:02:00Z"
archived_by: "Phying News (https://phying.com/item/7527)"
lang: "en"
---

# Codex Security

Codex Security helps you find, investigate, and fix vulnerabilities in your code. Use its security workflows in Codex, or automate them with the `@openai/codex-security` CLI and TypeScript SDK.

*Source: [github.com/openai/codex-security](https://github.com/openai/codex-security) · Published: 2026-08-28T13:51:50Z*

- **In Codex:** [choose a security workflow](https://github.com/openai/codex-security/blob/main/docs/agent-workflows.md).
- **In a terminal:** [install the CLI and scan your repository](#quick-start).
- **In automation:** use the [TypeScript SDK](#typescript-sdk) or [GitHub Action](#github-actions).

## Features

- Scan repositories, selected paths, or Git changes. Deep scans run parallel discovery workers on repositories and selected paths.
- Validate candidate findings, generate patches, and verify existing fixes.
- Draft `SECURITY.md` policies and save threat models for later review.
- Browse saved scans and findings, identify duplicates, assess severity against your own rubric, and suggest owners from source and Git history.
- Import GitHub code scanning alerts, export SARIF, JSON, or CSV, and publish findings to Linear or a findings service.
- Automate scans across repositories or project components, including in CI and containers.

## Use in Codex

Open your repository in a Codex session with the Codex Security plugin enabled, then ask:

> Run a Codex Security scan on this repository, focusing on authentication and authorization. Return the saved report, source evidence, and coverage limits.

A completed scan saves a report, findings, coverage, and a threat model when available. Use those results to investigate findings, request a patch, or verify an existing fix. See the [agent workflow guide](https://github.com/openai/codex-security/blob/main/docs/agent-workflows.md) for plugin setup, task selection, and recovery when required tools are unavailable.

## Quick start

Requires Node.js 22.13.0+ within 22.x, or Node.js 24.x or 26.x, and Python 3.10+. Python 3.10 also requires `tomli`.

Install the CLI globally and sign in:

```bash
npm install --global @openai/codex-security
cs login
```

`cs` is a short alias for `codex-security`; both commands run the same CLI. The installation creates both commands in npm's global executable directory, which must be on your `PATH`. If `cs` already resolves to another tool, use `codex-security` instead. If npm stops with an `EEXIST` error for `cs`, use `npx @openai/codex-security` without a global installation.

Run your scan from the repository directory:

```bash
cs scan .
```

If you have Daybreak Blue access, add `--cyber-access-program daybreak_blue` to the scan command. Otherwise, omit the flag or use `--cyber-access-program standard`.

To use Codex's Daybreak toggle, pass `--codex daybreak=true`. It defaults off and requires compatible access. See [Daybreak configuration](https://github.com/openai/codex-security/blob/main/sdk/typescript/docs/cli.md#daybreak-opt-in) for SDK and plugin usage, including Deep Scan workers.

Scans use your existing `SECURITY.md` guidance. You can optionally [draft or update a policy](#generate-securitymd) before scanning.

To run without a global installation, replace `cs` in these examples with `npx @openai/codex-security`, for example:

```bash
npx @openai/codex-security scan .
```

For CI, set `OPENAI_API_KEY` or `CODEX_API_KEY` in the scan process's environment. On remote or headless machines, use `login --device-auth` if your workspace allows it, or [sign in over SSH](https://github.com/openai/codex-security/blob/main/sdk/typescript/README.md#remote-login-with-ssh-forwarding).

Some cybersecurity requests and protected findings require [Trusted Access for Cyber](https://chatgpt.com/cyber) approval.

### Scan options

Choose a scope and scan mode:

```bash
# Scan selected paths.
cs scan . --path src --path tests

# Scan committed changes from a base revision to HEAD.
cs scan . --diff origin/main

# Run a deep scan of the repository.
cs scan . --mode deep
```

Use `cs scan . --max-time 15` for an advisory 15-minute Standard investigation allowance. See [investigation time](https://github.com/openai/codex-security/blob/main/sdk/typescript/docs/cli.md#set-investigation-time) for timing semantics and Deep Scan limits.

Use `cs --help` to browse commands, or `cs scan --help` for scan options, cost limits, and patching after a scan.

### Investigate findings and generate patches

Use an issue number from the scan summary to view a finding, request a patch, or verify a fix:

```bash
# View finding details and evidence.
cs finding show 1

# Generate and test a fix.
cs finding patch 1

# Verify a fix you wrote yourself.
cs finding verify 1
```

### Generate a security policy

Draft or update `SECURITY.md` to guide future scans:

```bash
# Draft a policy from repository analysis.
cs policy generate

# Update the existing policy with new questions or changed context.
cs policy update
```

The command checks for a policy file in your workspace, creates or updates one from source analysis, and shows what changed. Review and commit `SECURITY.md` so future scans use it automatically. If the command says the policy is already up to date, no copy is needed.

## Save and export threat models

Scans and policy generation save threat models with their results. Export a saved model without starting another analysis:

```bash
cs export --scan SCAN_ID --artifact threat-model --output threatmodel.md
```

Omit `--scan` to use the current repository's latest completed scan. The [export guide](https://github.com/openai/codex-security/blob/main/sdk/typescript/docs/cli.md#exports-and-ci) also covers findings, SARIF output for CI, and the offline TypeScript API.

## GitHub Actions

Run scheduled, manual, or pull request scans with the GitHub Action. For a weekly repository scan, add an OpenAI API key as the repository secret `CODEX_SECURITY_API_KEY`, then save this workflow in `.github/workflows/codex-security.yml`. Replace `REPLACE_WITH_REVIEWED_COMMIT` with the full SHA of an Action commit.

```yaml
name: Codex Security
on:
  workflow_dispatch:
  schedule:
    - cron: "23 7 * * 1" # Mondays at 07:23 UTC

permissions:
  contents: read

jobs:
  security:
    runs-on: ubuntu-24.04
    steps:
      # Configure Bubblewrap and AppArmor so Codex Security can run safely in its sandbox.
      - name: Set up the Ubuntu sandbox
        run: |
          sudo apt-get update
          sudo apt-get install --yes bubblewrap apparmor-profiles
          sudo apparmor_parser -r /usr/share/apparmor/extra-profiles/bwrap-userns-restrict
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: openai/codex-security@REPLACE_WITH_REVIEWED_COMMIT
        with:
          model: gpt-5.6-sol
          effort: high
          cyber-access-program: daybreak_blue
        env:
          OPENAI_API_KEY: ${ secrets.CODEX_SECURITY_API_KEY }
```

Findings are report-only by default. Set a severity threshold to fail on reported findings at or above it. Scanner and required reporting errors fail the job; intentional file exclusions and investigation notes do not.

## Containerized bulk scans

Scan a list of repositories with the included Docker Compose configuration, which keeps results and authentication between runs. See the [container quick start](https://github.com/openai/codex-security/blob/main/sdk/typescript/docs/cli.md#containerized-bulk-scans). The [workflow runner](https://github.com/openai/codex-security/blob/main/docker/README.md#workflow-runner) runs individual CLI stages in containers and can connect to a separately deployed findings service.

## Findings storage and deduplication

The [findings guide](https://github.com/openai/codex-security/blob/main/sdk/typescript/docs/findings-service.md) covers local storage, deduplication, and compatibility with independently operated endpoints through `publish scan --to custom` and explicit `--findings-url`. The local `serve` command and browser dashboard have been removed; existing databases and scan artifacts remain available.

## Other providers

Scans support OpenAI, Amazon Bedrock, OpenRouter, Fireworks AI, and Cheaper Inference. Bedrock uses AWS credentials and does not require a separate OpenAI login. See [Bedrock setup](https://github.com/openai/codex-security/blob/main/docs/bedrock.md) for AWS profiles, regions, and model access.

## Documentation

- [Online documentation](https://learn.chatgpt.com/docs/security/cli)
- [Agent workflows and recovery](https://github.com/openai/codex-security/blob/main/docs/agent-workflows.md)
- [CLI reference](https://github.com/openai/codex-security/blob/main/sdk/typescript/docs/cli.md)
- [Project configuration](https://github.com/openai/codex-security/blob/main/docs/project-configuration.md)
- [Examples](https://github.com/openai/codex-security/blob/main/examples/README.md)

---
> 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/7527) · Original source: [github.com/openai/codex-security](https://github.com/openai/codex-security)