Codex Security

Install the package with npm (Node 22.13.0 or later and Python 3.10 or later are required), run codex-security login, then codex-security scan /path/to/directory. In CI you skip the login and set OPENAI_API_KEY instead. A scan discovers repositories, tracks findings across runs so results are comparable over time, and records false-positive feedback so a dismissed finding stays dismissed.

From there it fans out. Bulk campaigns run from a CSV inventory and resume where they stopped. CI runs review pull-request changes, preserve artifacts, upload SARIF and enforce a severity policy.

• •Validation Before Reporting - Candidate findings are checked in an isolated environment against a repository-specific threat model before they reach you, with validation evidence attached, which is aimed squarely at the false-positive problem
• •Four Surfaces, One Scanner - A ChatGPT desktop plugin with a Security workbench for scans, findings and repositories; a terminal CLI; a TypeScript SDK; and Codex Security cloud for connected GitHub repos
• •Provider Independence - Runs against OpenAI, Amazon Bedrock, OpenRouter or Fireworks by setting the relevant key and selecting a model, so it is not tied to one inference vendor
• •CI Integration with SARIF - Review changes on a pull request, preserve artifacts, upload SARIF and apply a severity policy as a merge gate
• •Cost Controls - --max-cost sets an estimated ceiling in USD; when a deep scan reaches it, the CLI saves a report with partial coverage and exits with code 2 rather than silently continuing

Security engineers who own an application security program and are drowning in scanner output, and engineering teams who want a security gate on pull requests without buying a platform. The SARIF output and severity policy make it a drop-in for an existing CI pipeline, and the SDK is there for anyone building security review into their own internal tooling.