Overview
Codex Security is an open-source security tool launched by OpenAI, providing a CLI and TypeScript SDK to help developers efficiently discover, verify, and fix security vulnerabilities in code. It can scan entire repositories, review code changes, track security findings over time, and integrate into CI pipelines for security checks. The tool aims to seamlessly embed security practices into development workflows, enhancing code security.
Key Features
- Repository Scanning and Vulnerability Discovery: Supports comprehensive scanning of code repositories to automatically identify potential security vulnerabilities, including common types such as injection and cross-site scripting.
- Change Review and Verification: Can review code changes and verify whether newly introduced code poses security risks, helping developers fix issues before merging.
- Tracking and Historical Analysis: Tracks changes in security findings over time, providing historical records and trend analysis to help teams continuously monitor security status.
- CI Integration for Security Checks: Can be integrated into continuous integration (CI) pipelines to automatically perform security checks, ensuring every commit meets security standards.
Use Cases
- Development teams automatically scan code security vulnerabilities in CI/CD pipelines
- Security auditors conduct regular security reviews of repositories
- Open-source project maintainers verify the security of contributed code
Pros
- Open-source and free, lowering the barrier to using security tools
- Provides both CLI and SDK, flexibly adapting to different development environments
- Maintained by OpenAI, with continuous updates and community support
- Supports tracking historical findings, facilitating long-term security management
Pricing
Open-source and free, all features are available without payment.
Summary
Codex Security is an open-source security tool launched by OpenAI, offering repository scanning, change review, finding tracking, and CI security checks via CLI and TypeScript SDK. It helps development teams integrate security practices into daily workflows, effectively improving code security, and is completely free to use.
Version History
- 商汤发布 SenseNova U1.5-Lite-Preview 开源模型 (2026-08-03): 商汤推出 SenseNova U1.5-Lite-Preview，一个基于 NEO-Unify 架构的轻量级原生统一多模态模型，仅 8B-MoT 参数即可达到商业闭源模型的生成与编辑质量。
- 微软开源 Orchard 智能体训练框架 (2026-08-03): Orchard 是一个面向研究社区的开源框架，用于跨任务类型训练和评估 AI 智能体。它降低了复杂性，同时通过让研究人员复用同一套基础设施，支持较小模型也能实现强劲性能。https://msft.it/6019a8fqP
- OpenAI 发布 Codex 安全 CLI 与 SDK (2026-07-28): More open-source benefits. We just released a CLI and TypeScript SDK for finding, verifying, and fixing security vulnerabilities in code. Scan repositories, review changes, track findings over time, and run security checks in CI. https://github.com/openai/codex-security
- 腾讯混元开源 AngelSpec 投机解码框架 (2026-07-29): Tencent Hunyuan open-sourced the end-to-end speculative decoding framework AngelSpec, supporting both training and deployment. On the Hy3-A21B model, its DFly scheme achieves a 1.98-2.40x end-to-end speedup compared to autoregressive decoding, with throughput 10.5-11.8% higher than DFlash. The training code and Hy3-A21B MTP/DFly draft model weights have been open-sourced.