OpenAI open-sources Codex Security tooling layer, detailing setup, scans, CI integration and cost pitfalls
OpenAI has released the GitHub repository for Codex Security under the Apache-2.0 license, but the open-source code covers only the tooling layer used to trigger scans, manage findings and integrate with CI. The underlying service that reads code, reproduces vulnerabilities in isolated environments and generates patches still runs on OpenAI’s own servers, so access still requires an OpenAI login and Codex Security permissions. According to the documentation cited in the source article, Codex Security remains in research preview and is available to ChatGPT Pro, Business, Edu and Enterprise users, with some enterprise accounts also needing admin approval. The article walks through environment requirements, install commands, dry-run validation, model configuration, SARIF export and CI usage, then highlights five common pitfalls: max-cost not acting as a hard cap, output directories being blocked if placed inside a repository, API keys taking precedence over ChatGPT login in non-interactive contexts, Python 3.10 needing tomli, and MCP being limited to read-only metadata rather than live scans. It also covers local scan history in SQLite, false-positive handling, scan comparison, batch scanning across GitHub repositories, and the related TypeScript SDK APIs.


