%20--%3e%3cdefs%3e%3cstyle%3e%20.st0%20{%20fill:%20%23061b40;%20}%20.st1%20{%20fill:%20%23306af1;%20}%20.st2%20{%20fill:%20%235ce5cf;%20}%20%3c/style%3e%3c/defs%3e%3cg%3e%3cpath%20class='st0'%20d='M55,10.5h9v3h-9v9h12V7.5h-12v3ZM64,19.5h-6v-3h6v3Z'/%3e%3cpolygon%20class='st0'%20points='69%2016.5%2078%2016.5%2078%2019.5%2069%2019.5%2069%2022.5%2081%2022.5%2081%2013.5%2072%2013.5%2072%2010.5%2081%2010.5%2081%207.5%2069%207.5%2069%2016.5'/%3e%3cpolygon%20class='st0'%20points='95%2010.5%2095%207.5%2083%207.5%2083%2022.5%2095%2022.5%2095%2019.5%2086%2019.5%2086%2016.5%2095%2016.5%2095%2013.5%2086%2013.5%2086%2010.5%2095%2010.5'/%3e%3cpath%20class='st0'%20d='M40,1.5v21h11.6l1.4-1.4v-7.6h0c0,0-1.4-1.5-1.4-1.5l1.4-1.4V2.9l-1.4-1.4h-11.6ZM50,19.5h-7v-6h7v6ZM50,10.5h-7v-6h7v6Z'/%3e%3c/g%3e%3cpath%20class='st1'%20d='M23.1,24L14.7,4.8l-4.9,11.2h3.8l-1.8,4H3.3L12.1,0H2C.9,0,0,.9,0,2v20c0,1.1.9,2,2,2h21.1Z'/%3e%3cpath%20class='st2'%20d='M34,0h-16.8l10.6,24h6.2c1.1,0,2-.9,2-2V2C36,.9,35.1,0,34,0ZM32.5,20h-4V4h4v16Z'/%3e%3c/svg%3e)
OpenAI officially announced the open-source command-line security tool Codex Security CLI today, helping developers scan code repositories, identify and verify security vulnerabilities in their daily coding workflow, and support seamless integration of security checks into CI/CD delivery pipelines. Interestingly, OpenAI admitted that the tool was already "discovered" by the community before its official release, and it is still in an early version stage.
Two channels: Command line + SDK, directly connecting to CI/CD pipeline
Codex Security CLI uses a command-line interface as its core interaction method, and also provides a TypeScript SDK interface. Developers can use it to scan code repositories, view code changes, track security issues across different run cycles, and verify the effectiveness of vulnerability fixes.
For continuously developed software projects, after embedding this tool into the CI/CD process, each code submission can automatically trigger a security check, exposing potential risks in advance. The installation method is extremely simple, just one line of command via npm. The tool requires Node.js 22 or higher, Python 3.10 or higher, and access rights to Codex Security. After completing authentication, developers just need to execute the scan command to perform a security review of the code repository.
In a CI environment, there is no need for interactive login; automated authentication can be completed by setting the OPENAI_API_KEY environment variable. The tool also supports two authentication methods: ChatGPT account login and API key, meeting the different needs of individual developers and enterprise teams.
The scan history will be saved in the Codex Security working directory. If the default directory is not writable, users can also customize the storage path through environment variables. For advanced users, the TypeScript SDK allows direct invocation of the security scanning function within a TypeScript project, obtaining the scan report path to achieve more flexible toolchain integration.