OpenAI open source Codex security scanning tool, inserts vulnerability detection into the developer command line OpenAI today officially announced the open source command line security tool Codex Security CLI, which helps developers scan the code warehouse, discover and verify security vulnerabilities in the daily coding process, and supports the seamless integration of security checks into CI/

OpenAI open source Codex security scanning tool, plugging vulnerability detection into the developer command line OpenAI today officially announced the open source command line security tool Codex Security CLI, which helps developers scan the code warehouse, discover and verify security vulnerabilities in the daily coding process, and supports the seamless integration of security checks into the CI/CD continuous delivery pipeline. Interestingly, OpenAI admitted that the tool had been "excavated" by the community in advance before it was officially released, and it is still in the early version stage. Command line + SDK dual channel, directly connected to the CI/CD pipeline. Codex Security CLI uses the command line interface as the core interaction method and also provides a TypeScript SDK interface. Developers can use it to scan code repositories, view code changes, track security issues in different run cycles, and verify vulnerability fixes. For continuously developed software projects, after embedding this tool into the CI/CD process, each code submission can automatically trigger security detection and expose potential risks in advance. The installation method is extremely simple and can be completed with one line of npm commands. The tool requires Node.js22 or higher, Python 3.10 and above, and access to Codex Security. After completing the authentication, developers only need to execute the scan command to conduct a security review of the code repository. In a CI environment, without interactive login, automated authentication can be completed by setting the OpenAI_API_KEY environment variable. The tool supports both ChatGPT account login and API key authentication methods to meet the different needs of individual developers and enterprise-level teams. The scanning history will be saved in the Codex Security working directory. If the default directory is not writable, users can also customize the storage path through environment variables. For advanced users, the TypeScript SDK allows you to directly call the security scanning function in the TypeScript project, obtain the scan report path, and achieve more flexible tool chain integration. The launch of Codex Security CLI marks that OpenAI is extending AI security capabilities from the model level to the developer tool chain. When security detection is as accessible as code formatting, what does this mean for the defense level of the entire software development ecosystem? The answer may be much deeper than a CLI tool itself. via AI News (author: AI Base)