codex-security

Why we included this project

Codex Security takes a different route than most scanners: instead of matching known signatures, it runs an agentic scan that hunts for vulnerabilities, then checks whether they are real before proposing fixes. It is built on the Codex runtime, so you can run it in deep mode with multiple workers and subagents and get a report that separates new findings from ones that persist, and shows which have been reopened or resolved since the last scan. That works in CI as well as for local review, and it can use inference providers other than OpenAI's own models. Teams already using Codex for coding will find the workflow familiar, and the SDK makes it possible to embed scanning in your own tooling. It does require access to Codex Security and a supported Node.js runtime, so it is not an offline scanner.