Codex Security

github.com

July 28, 2026

1 min read

🔥🔥🔥🔥🔥

69/100

Summary

OpenAI Codex Security provides a CLI and TypeScript SDK for identifying, validating, and fixing security vulnerabilities in code. It supports scanning repositories, reviewing changes, tracking findings over time, and running security checks in continuous integration environments, requiring Node.js 22 or later and Python 3.10 or later.

Key Takeaways

OpenAI's Codex Security provides a CLI and TypeScript SDK for identifying and addressing security vulnerabilities in code.
The tool requires Node.js 22 or later and Python 3.10 or later for installation and operation.
Users can perform scans, track findings, and run security checks in continuous integration (CI) environments using the Codex Security SDK.
Scan history is stored in a designated workbench state directory, which can be configured if the default directory is not writable.

Read original article

View story →

Coverage & discussions

Hacker News · github.com

Codex Security ↗

Community discussions

Hacker News discussion ↗

Historical count: 5 · 5 saved in sample · Historical sample

Analysis ready

Community Sentiment

Mixed

Positives

Open-sourcing Codex Security is a bold move that shows a commitment to community feedback and rapid improvement — users appreciate the chance to contribute to its evolution.
Some commenters are excited about the potential for real-time vulnerability scanning, envisioning how this tool could streamline security processes that used to take ages.
The CLI integration seems to excite users who are eager to see how it can fit into their existing workflows, suggesting a promising developer experience.

Concerns

The tool's performance is under fire; users are frustrated by rate limits and incomplete scans that waste time and money — half a week's usage for a failed run is not acceptable.
Concerns about security tools from AI companies being potentially self-serving are raised, with one user likening them to fire departments run by arsonists.
Multiple users expressed annoyance at unclear usage limitations, like compatibility issues with certain types of projects, which could alienate potential users.