Codex Security

Codex Security at a glance

Good for

What Codex Security is used for

• Scan a repository, selected paths or a Git diff for vulnerabilities, from a terminal, in CI or inside Codex.
• Validate candidate findings, generate a patch, and verify whether an existing fix works.
• Draft a SECURITY.md policy and save threat models.
• Export findings as SARIF, JSON or CSV, or track them in Linear, Jira or GitHub.

Codex Security pricing and key facts

• Made by OpenAI. The CLI and TypeScript SDK are open source under Apache 2.0 and ship as the npm package @openai/codex-security (commands codex-security or cs).
• Latest release: 0.10.0, published November 11, 2026 (Toronto time). It adds resumable Standard scans and a shared cost budget for batch scans.
• Scans need a ChatGPT sign-in with Codex Security access, or an API key. Besides OpenAI, the CLI can use OpenRouter, Fireworks or Amazon Bedrock.
• Needs Node.js 22.13+, 24 or 26, and Python 3.10+.
• The CLI runs with your own operating-system permissions and doesn't pause for approval, so OpenAI advises removing unrelated credentials first.

From the official site, checked 2026-11-12: github.com/openai/codex-security, github.com/openai/codex-security/releases/tag/npm-v0.10.0, developers.openai.com/codex/security, learn.chatgpt.com/docs/security/cli/reference.

Codex Security FAQ

Is Codex Security open source?

The CLI and TypeScript SDK are open source under Apache 2.0. Scans still use a model, through a ChatGPT sign-in with Codex Security access or an API key.

How do I install the Codex Security CLI?

Run npm install --global @openai/codex-security, sign in with cs login, then run cs scan . in your repository.

Can it fix the vulnerabilities it finds?

It can generate a patch for a finding and verify whether a fix works. You review the result before using it.

Alternatives to Codex Security

More Coding task guides