openai/codex-security

What it solves

It provides a way to automatically find, validate, and fix security vulnerabilities in codebases using AI, reducing the manual effort required for security audits.

How it works

The project provides a CLI and a TypeScript SDK that can scan directories of code. It can be run as a standalone tool or integrated into CI pipelines. It supports multiple inference providers (including OpenAI, Amazon Bedrock, OpenRouter, and Fireworks) and allows users to select specific models to perform the analysis.

Who it’s for

Developers and security engineers who want to integrate AI-driven vulnerability scanning and remediation into their development workflow or CI/CD pipelines.

Highlights

• Multi-provider support: Supports various LLM providers like Amazon Bedrock, OpenRouter, and Fireworks in addition to OpenAI.
• Containerized bulk scans: Includes Docker Compose configurations for scanning multiple repositories at scale.
• Findings service: A preview feature that stores findings and embeddings in SQLite, provides a read-only dashboard, and uses embedding similarity to identify and group duplicate vulnerabilities.
• TypeScript SDK: Allows programmatic access to the security scanning capabilities.