codex-security - OpenAI's Codex Security CLI and TypeScript SDK for

项目说明

Codex Security

/codex-security is a CLI and TypeScript SDK for defining security policy and finding, , and fixing security in your code.

👉👉 See the Codex Security documentation for full documentation.

Some cybersecurity requests and protected findings require appro
Trusted Access for Cyber. To join the program, visit
chatgpt.com/cyber.

Quick start

Requires Node.js 22.13.0 or later and Python 3.10 or later.

For CI, set OPENAI_API_KEY instead of signing in.

Generate SECURITY.md

Draft repository-wide or component-scoped SECURITY.md guidance for future scans:

The command saves a draft outside the checkout; it does not install it or run a
scan. Review the proposed diff before copying the policy. Supporting architecture,
threat-model, and review documents stay outside the repository and may contain
sensiti. See the SDK policy guide
for headless generation, sa, and SDK usage.

Save and export threat models

Scans and policy generation retain their threat model with the run and write
a threatmodel.md copy when possible. Export the sa without starting
another analysis:

The default source is the current repository's latest completed scan. Explicit
scan IDs or result directories can export sa models. See the
export guide for policy results,
stdout, and the offline TypeScript API.

TypeScript SDK

To suggest owners for existing findings from source and Git history, see
Suggest finding owners.

Codex Security is a Ja package:

Containerized bulk scans

Use the included Docker Compose configuration for scans of many repositories. See the container quick start for more detail.

For indi CLI stages with durable state and access to a separately deployed
findings service, use the same scanner image with the
workflow runner Compose example.

Findings service (preview)

Run npx /codex-security serve to start the service without Docker. See
running without Docker
for prerequisites, credentials, and storage configuration.

The findings service runs
from the same ghcr.io/openai/codex-security image as the scanner (or a local
source build), with a separate container and state configured by
compose.findings.yaml. It stores findings and embeddings in SQLite and lists
findings with pagination. Its read-only dashboard at /dashboard refreshes every
fi and shows stored findings and duplicate groups from the service's
database. It also returns potential duplicates by embedding similarity within a
repository or an explicit all-repository scope. The
npx /codex-security publish scan --to custom --findings-url
command uploads completed findings and their repository ID. The SDK and
npx /codex-security dedupe command retrie, run independent Codex
reviews locally, and persist accepted duplicate groups; --all-repositories
opts into the broader scope.

Use npx /codex-security classify-se --scan SCAN_ID --rubric /path/to/policy.md
to assess selected findings under your own policy before publishing tickets.
Scan classification checkpoints each finding in SQLite and reuses matching
assessments on reruns; --reprocess forces reassessment. The SDK exposes the same
classification operation; original scan se stays unchanged. See se classification.

Other pro

Amazon Bedrock uses nati support; no connector or adapter is needed.
Select an AWS profile, the region where your account can invoke the model, and
the Bedrock model ID:

Run the exports and scan in the same shell. Bedrock also accepts bearer tokens
and the AWS credential chain. Nati scans and local result or
export do not require an OpenAI CLI login. Daybreak Blue and Red still need
appro access. Hosted publication has its
own authentication requirements. See Bedrock setup and .

For other inference pro, set the provider's API key and select a model:

Documentation

👉👉 See the Codex Security documentation for full documentation.

See project configuration for reusable YAML/JSON
settings, CLI o, and editor schema support.

项目信息

开发语言：TypeScript

Star 数：10970

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。