What problem it solves

Security vulnerabilities require investigation across code, source history, policies, and existing findings. Codex Security provides workflows to scan code, validate candidate issues, generate patches, verify fixes, and organize security work across local development, automation, and connected tools.

Key features

• Repository and change scanning — Scan entire repositories, selected paths, or Git changes. Deep scans repeat Standard scans and return their deduplicated findings.

  Source: README

• Finding validation and remediation — Validate candidate findings, generate patches, and verify existing fixes before accepting or resolving a security issue.

  Source: README

• Security policies and threat models — Draft SECURITY.md policies, select specific components for policy generation, and save threat models with scan and policy results for later review.

  Source: README

• Import, tracking, and export — Preview third-party scanner findings and save them locally, then track findings in Linear, Jira, or GitHub and export reports in common formats.

  Source: README

• Automation and integrations — Automate scans across repositories or project components with the CLI, TypeScript SDK, GitHub Action, CI, and containerized workflows.

  Source: README, github-action, compose.runner.yaml

Quick start

Copied verbatim from the project's README.

npm install --global @openai/codex-security
cs login

cs scan .

Who it may suit

Inference: this may suit developers who want to investigate and fix vulnerabilities directly in a repository, as well as teams that need to incorporate security scanning into CI, containers, or issue-tracking workflows.

Topics to discuss

• Which security workflows should be made easier to discover and run from the CLI?

• How should teams review source evidence, severity classifications, and coverage limits before accepting findings?

• Which integrations and report formats are most useful for a repeatable vulnerability-management process?

Written by ReadmeX AI from the project's README, source and public GitHub data; it may contain mistakes.

Read the original README https://github.com/openai/codex-security#readme

ReadmeX opened this community for a trending project; it is not run by the project. Maintainers can claim it from the community page.