codex-security: OpenAI Security CLI: Automating from Code Scanning to Patch Generation

Provides a security workflow that discovers and verifies vulnerabilities in your codebase and automatically generates fix patches. You can specify the scan scope to target the entire repository, specific paths, or only Git changes. It supports Standard mode and Deep mode, which removes duplicate results, allowing you to control the depth of investigation.

Beyond simple detection, it verifies candidate vulnerabilities and checks existing fixes. It can draft a SECURITY.md policy and save threat models for later review. It also includes features to analyze source code and Git history to assess vulnerability severity and suggest assignees.

Automation is supported in CI/CD pipelines or container environments via CLI, TypeScript SDK, and GitHub Action. It integrates with Linear, Jira, and GitHub to track vulnerabilities and can export them in SARIF, JSON, and CSV formats. Various LLM providers, including OpenAI, Amazon Bedrock, and OpenRouter, can be used as backends.

Requires Node.js 22.13.0 or higher and Python 3.10 or higher, and is distributed under the Apache-2.0 license. It can be used as a plugin in the Codex environment or run directly from the terminal, making it suitable for integrated code security management for development and DevSecOps teams.