OpenAI has released Codex Security, an open-source CLI and TypeScript SDK designed to identify, validate, and review security vulnerabilities in code. This tool supports macOS, Linux, and Windows, requiring Node.js 22+ and Python 3.10+ for scanning and exporting findings.

Users can authenticate using their OpenAI account or an API key. Scans are restricted to repositories the user owns or has explicit permission to assess. Installation is done via `npm install @openai/codex-security`. Key commands include `npx codex-security login` and `npx codex-security scan /path/to/repo`.

The CLI offers various options for targeted scans, such as specifying paths, using custom knowledge bases, and performing differential scans. Results can be exported in formats like SARIF, CSV, and JSON. Features like `install-hook` scan staged changes before commits, and `bulk-scan` allows for scanning multiple GitHub repositories. The tool aims to provide detailed vulnerability information, including severity and reproduction steps, with an emphasis on keeping scan artifacts secure.