openai/codex-security

@openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code.

Requires Node.js 22.13.0+ within 22.x, or Node.js 24.x or 26.x, and Python 3.10+. Python 3.10 also requires tomli.

cs is a short alias for codex-security; both commands run the same CLI. The installation creates both commands in npm's global executable directory, which must be on your PATH. If cs already resolves to another tool, use codex-security instead. If npm stops with an EEXIST error for cs, use npx @openai/codex-security without a global installation.

From your repository, optionally draft a SECURITY.md that explains what counts as a security issue in your project:

The draft is saved outside your repository. Review the diff and notes, edit the draft, then copy only SECURITY.md to the Policy target shown. Skip this step to keep your current policy or scan without one.

Run your scan from the repository directory:

If you have Daybreak Blue access, add --cyber-access-program daybreak_blue to the scan command. Otherwise, omit the flag or use --cyber-access-program standard.

To run without a global installation, replace cs in these examples with npx @openai/codex-security, for example:

For CI, set OPENAI_API_KEY or CODEX_API_KEY in the scan process's environment. On remote or headless machines, use login --device-auth if your workspace allows it, or sign in over SSH.