ArchestackBest of Vibe Coding: List on GitHub ↗ (opens in a new tab)

#1515th of 43 in Code review and testing

codex-security

Vulnerability scanner, validator and patcher with a CLI, TypeScript SDK and Codex plugin

Documentation ↗ (opens in a new tab)Repository on GitHub ↗ (opens in a new tab)
Stars
12.2k
License
Apache-2.0
Last commit
Nov 2026
Last release
Nov 2026
Language
TypeScript
Stars, last 17 weeks+11,822
15 Jul 2026: 339 stars22 Jul 2026: 339 stars29 Jul 2026: 5,619 stars5 Aug 2026: 9,109 stars12 Aug 2026: 9,933 stars19 Aug 2026: 10,213 stars26 Aug 2026: 10,447 stars2 Sept 2026: 10,584 stars9 Sept 2026: 10,851 stars16 Sept 2026: 10,988 stars23 Sept 2026: 11,089 stars30 Sept 2026: 11,205 stars7 Oct 2026: 11,293 stars14 Oct 2026: 11,397 stars21 Oct 2026: 11,470 stars28 Oct 2026: 11,567 stars4 Nov 2026: 11,635 stars11 Nov 2026: 12,161 stars

339 on 15 Jul 202612,161 on 11 Nov 2026

From GitHub's daily star counts.

Checked on GitHub.

OpenAI is hiring: 829 open roles

Overview

Codex Security scans repositories, paths or Git diffs for vulnerabilities, validates candidate findings, generates patches and verifies existing fixes. It runs as a Codex plugin, as the `cs` CLI (`@openai/codex-security`), through a TypeScript SDK, or as a GitHub Action. Results can be exported as SARIF, JSON or CSV, or sent to Linear, Jira or GitHub.

Who it is for: Security and platform engineers scanning code for vulnerabilities

Strengths

  • Scans whole repos, selected paths, or diffs against a base revision
  • Exports SARIF, JSON and CSV; integrates with Linear, Jira, GitHub and ServiceNow
  • Supports OpenAI, Amazon Bedrock, OpenRouter, Fireworks AI and Cheaper Inference
  • Ships a GitHub Action, SDK and Docker Compose setup for bulk scans

Weaknesses

  • Requires Node.js 22.13+/24/26 and Python 3.10+ installed
  • Needs an OpenAI login or API key, or other provider credentials
  • Some cyber requests and protected findings need Trusted Access for Cyber
  • Local serve command and browser dashboard have been removed

What it needs

  • no GPU
  • Docker + Compose
  • Needs Node.js 22.13+, Python 3.10+, OpenAI API key or other provider credentials
  • Models: OpenAI, Amazon Bedrock, OpenRouter, Fireworks AI, Cheaper Inference

What changed

  1. action-v0.10.0 ↗ (opens in a new tab)
  2. npm-v0.10.0 ↗ (opens in a new tab)Breaking

    “POSIX paths through symlinks. Paths such as link/../repo now follow filesystem traversal. To resume an older bulk campaign whose source was normalized differently, enter its exact saved source path i…”

  3. npm-v0.9.0 ↗ (opens in a new tab)Breaking

    “Deep Scan budgets. --stop-after-no-new now counts consecutive completed Standard reviews that add no findings. If you depend on a particular run length, review this threshold alongside --max-discover…”

From the release notes. No flag means the note does not say so, not that the upgrade is safe.

Also in Code review and testing

See all 43
Also in Code review and testing
RankProjectScore
1playwrightCross-browser automation and end-to-end test framework for Chromium, Firefox and WebKit100k stars+2,481 (+2.5%) in 30 daysApache-2.094 out of 100
2nxMonorepo build system with task caching, affected-only runs and CI integration29.5k starsMIT93 out of 100
3open-code-reviewGo CLI that reviews Git diffs with an LLM agent and line-level comments50k stars+3,413 (+7.3%) in 30 daysApache-2.092 out of 100
#4bendDependent-typed language where AI-written code must prove rules in LAWS.bend Live demo ↗ (opens in a new tab)25k starsApache-2.088 out of 100
#5maestroYAML-based UI and end-to-end test framework for Android, iOS and web16.4k starsApache-2.088 out of 100