OpenAI Opens Codex Security CLI for Repository Scans

What Changed

Application-security review is moving closer to the terminal and the CI pipeline. OpenAI posted that Codex Security CLI is now available as an open-source package, giving developers a local way to scan repositories and carry security checks across repeated runs.

"We quietly released the open-source Codex Security CLI, but Hacker News found it before we had a chance to share it here... You can now use it to scan repositories, track findings across runs, verify fixes, and add security checks to CI/CD." - OpenAI

FxTwitter data shows the post with 9357 likes and 640,501 views, which is strong engagement for a developer tool. The linked GitHub repository describes @openai/codex-security as a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in code that users own or are allowed to assess. The practical scope is repository scanning, change review, tracking findings over time, and CI checks.

The OpenAI account is the company’s official channel for model, ChatGPT, Codex, and research updates. Here, the interesting part is not the playful note that Hacker News found the release early. It is that a Codex-branded security workflow is being distributed as developer tooling rather than only as a hosted feature. That creates a clearer path for teams that want repeatable scans during pull requests or before release.

The early-release label still matters. AI-assisted security tools must prove they can handle false positives, produce reproducible findings, preserve useful evidence across runs, and avoid overreaching into secrets or unrelated files. Teams adopting the CLI should decide what findings block a build and what findings become tickets for human review.

Watch whether the package becomes part of standard GitHub Actions or GitLab CI templates, and whether its finding format maps cleanly to existing SAST, dependency scanning, and vulnerability-management systems. Source: OpenAI tweet.