Codex Security turns code scanning into a CLI and SDK
OpenAI has published Codex Security as a command-line tool and TypeScript SDK for scanning repositories, tracking findings, and putting checks into CI.
The project’s quick start is deliberately small: install the package, sign in, then scan the current repository.
Its real test is whether security findings remain useful once they move from an interactive scan into routine CI.
A security workflow, not only a report
Codex Security is published as a CLI and TypeScript SDK for finding, validating, and fixing code vulnerabilities. The repository describes repository scans, change review, finding history, and checks that can run in CI.
The first command is intentionally ordinary
The documented quick start installs @openai/codex-security, signs in, and runs npx codex-security scan .. That familiar shape matters: a scanner is easier to test when it can be run against the same working tree a developer already has open.
Credentials need an explicit choice
The project supports either ChatGPT sign-in or an API key. Its documentation notes that noninteractive CI keeps API-key precedence when both exist, while interactive scans ask which credential to use. That distinction prevents an unattended pipeline from silently behaving like a local session.
The operational question
The HN discussion was still forming, but the repository’s design makes the intended audience clear: teams that need a scan to feed an ongoing remediation workflow rather than produce an isolated one-off result. The useful evaluation is therefore not just whether it finds a bug, but whether its findings can be reviewed, stored, and acted on without disrupting development.
For a new security tool, that is the harder product boundary: detection is only the first handoff.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
A preclinical HIV vaccine result is promising, not a human trial
Researchers at La Jolla Institute report an experimental vaccine that produced broadly neutralizing antibodies in animal studies. The headline-worthy result still sits before the much harder clinical stage.