OpenAI Codex Security (CLI + TypeScript SDK)

OpenAI 开源 Codex Security：CLI + TypeScript SDK，定位 find/validate/fix 代码安全漏洞，支持整仓/路径/diff/工作区扫描findings 跟踪coverageSARIFCI 与 pre-commit最小路径 npm install @openai/codex-security npx codex-security login npx codex-security scan .；CI 用 OPENAI_API_KEY文档要求 Node 22+scan/export 需 Python 3.10+；CLI/SDK beta 且需要 access工程意义是把安全检查嵌进 edittestscanfixretest loop，而不是替代人工安全评审

OpenAI Codex Security (CLI + TypeScript SDK)

Source: https://github.com/openai/codex-security

Platform: github

Author: OpenAI

Original date: 2026-07-28

Summary (zh)

OpenAI 开源 Codex Security：CLI + TypeScript SDK，定位 find/validate/fix 代码安全漏洞，支持整仓/路径/diff/工作区扫描、findings 跟踪、coverage、SARIF、CI 与 pre-commit。最小路径 npm install @openai/codex-security → npx codex-security login → npx codex-security scan .；CI 用 OPENAI_API_KEY。文档要求 Node 22+、scan/export 需 Python 3.10+；CLI/SDK beta 且需要 access。工程意义是把安全检查嵌进 edit→test→scan→fix→retest loop，而不是替代人工安全评审。

Summary (en)

OpenAI open-sources Codex Security CLI/SDK for finding, validating, and fixing security vulnerabilities, with repo/diff scanning, findings tracking, SARIF/CI hooks; currently beta and access-gated.

One-liner

Agent 写完代码，安全扫描要进同一条 loop：Codex Security 把 scan 做成可嵌 CI 的部件。

Fetched / evidence body

openai/codex-security: SDKs and CLI for Codex Security

原文链接: https://github.com/openai/codex-security

Codex Security

#codex-security

@openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code. Scan repositories, review changes, track findings over time, and run security checks in CI.

Documentation

Quick start

#quick-start

Requires Node.js 22 or later, Python 3.10 or later, and access to Codex Security.

npm install @openai/codex-security
npx codex-security login
npx codex-security scan .

For CI, set OPENAI_API_KEY instead of signing in.

If both a ChatGPT sign-in and an API key are available, interactive scans ask which credential to use. CI and other noninteractive scans keep the existing API-key precedence. Select a credential explicitly when needed:

npx codex-security scan . --auth chatgpt
npx codex-security scan . --auth api-key

To make your ChatGPT sign-in the automatic default, unset any configured API keys:

unset OPENAI_API_KEY CODEX_API_KEY

Scan history is stored in the Codex Security workbench state directory. If that directory cannot be written, set CODEX_SECURITY_STATE_DIR to a writable directory outside the repository.

TypeScript SDK

#typescript-sdk

import { CodexSecurity } from "@openai/codex-security";

const security = new CodexSecurity();
const result = await security.run(".");

console.log(result.reportPath);
await security.close();

For installation, authentication, scan options, and CI setup, see the official documentation.

Obsidian evidence

OpenClaw定时任务/内容选题编排/2026-07-29-内容选题编排.md
Run date: 2026-07-29