openai / codex-security
OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security
- Stars
- 11,698 stars
- Forks
- 937 forks
- Language
- TypeScript
- License
- APACHE-2.0
- Created
- Jul 13, 2026
- Last push
- Nov 12, 2026
- Updated
- Nov 12, 2026
Why these Tags: an agent read the README and quoted it
- Static analysis from the readme:
Scan repositories, selected paths, or Git changes.
- Coding agent plugin from the readme:
Open your repository in a Codex session with the Codex Security plugin enabled,
An agent gave these Tags from the fixed Tag list in the AwesomeRepos source code. A code check kept each Tag only when its quote is in the text. A wrong Tag? Report an error with the form at the end of this page.
Admitted to the Repository Index on Nov 10, 2026: 11,347 stars on 2026-11-10.
Star History
108 days recorded, Jul 27, 2026 – Nov 11, 2026 (UTC). Net change +11,952 stars.
The star count of each day is the latest count minus the net stars of the later days.
Add this Star History to a README
The images follow the light or dark theme of the page that shows them, and update every hour.
Add ?theme=light or ?theme=dark
to the chart address to keep one theme.
Star History chart
[](https://awesomerepos.com/openai/codex-security) Badge
[](https://awesomerepos.com/openai/codex-security) Timeline
It gained stars on each of the 108 days recorded since Jul 27, 2026.
Its largest 7 days were Jul 28, 2026 to Aug 3, 2026: 8,311 stars.
In the 30 days to Nov 11, 2026 it got 924 stars, 102% more than in the 30 days before.
- Created on the Repository Host
- Reached 1,000 stars, 15 days after it was created
- Largest star day recorded: +2,740 stars
- Reached 5,000 stars, 16 days after it was created
- +2,539 stars in one day
- +1,903 stars in one day
- Reached 10,000 stars, 52 days after it was created
- Entered the Repository Index: 11,347 stars on 2026-11-10
- Release npm-v0.9.0: Codex Security 0.9.0 (source only)
- Release action-v0.9.1: Codex Security GitHub Action 0.9.1
- Release npm-v0.9.1: Codex Security 0.9.1
- Release action-v0.10.0: Codex Security GitHub Action 0.10.0
- Release npm-v0.10.0: Codex Security 0.10.0
- Latest push
The timeline comes from the creation date and the releases on the Repository Host, the Admission, the Star History, and the Observations. Star milestones show only when the Star History records the day. The list shows up to 5 stable releases from the latest 10 releases recorded. When none of them is stable, one item counts the pre-releases. On the chart of net stars each day, a solid line marks each recorded release.
Forks and pushes
From 2 Observations, Nov 11, 2026 – Nov 12, 2026. Forks +22. AwesomeRepos saw a new push on 1 of 1 days.
- Nov 12, 2026: new push
A filled day: the last push time changed since the Observation before it.
Health facts
Measured facts in four separate dimensions, each with a date and a source. AwesomeRepos does not add them into one score. AwesomeRepos last read these facts from GitHub on Nov 12, 2026. How AwesomeRepos defines each check
Copies a prompt for a coding agent. It has 2 tasks for the maintainers of openai/codex-security.
Improve the Health Facts of the GitHub repository openai/codex-security. AwesomeRepos measures facts about how a repository is maintained, released, secured, and documented. Its page for this repository is https://awesomerepos.com/openai/codex-security. A change to the repository can improve each of the 2 items below. Each item gives the measured fact or score, and a task. 1. The newest release tag is a semantic version Fact: The newest release tag is action-v0.10.0. Rule: The tag of the newest release has the form 1.2.3 or v1.2.3, with an optional pre-release or build part. There is no data when the repository has no release. Task: Make the next release tag a semantic version (1.2.3 or v1.2.3). Do not change or delete a published tag. If a release tool makes the tags, configure it for semantic versions, and write the version scheme in the contributing guide. 2. A code of conduct Fact: GitHub finds no code of conduct (GitHub, 2026-11-12). Rule: GitHub finds a code of conduct in the repository or in the owner's .github repository. Task: Add CODE_OF_CONDUCT.md at the root with the Contributor Covenant 2.1 text. Change only the contact method. Ask me for the contact; do not invent one. Rules for this work: - Each file must be true for this project. Do not copy text that does not apply to it. - Do not choose a licence, a contact, or a release version for me. Ask me. - Do not publish a release, change a repository setting, or push to the default branch. Make the changes on a new branch. - Keep each change small, and run the checks of this repository before you finish. - At the end, list each item as DONE, SKIPPED (with the reason), or NEEDS A DECISION (with the question). AwesomeRepos reads these facts again in its next scan. The definitions of the checks: https://awesomerepos.com/health-facts
Maintenance
3 of 4 checks-
Yes: Not archived
GitHub does not mark the repository as archived. Source
-
Yes: A push in the last 90 days
Last push on 2026-11-12, 0 days ago. Source
-
Yes: Commits in the last 13 weeks
1790 commits on the default branch in the last 13 weeks (GitHub, 2026-11-12). Source
-
No: Commits in 26 or more of the last 52 weeks
Commits in 18 of the last 52 weeks (GitHub, 2026-11-12). Source
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 0
- 5
- 36
- 96
- 56
- 57
- 97
- 70
- 80
- 34
- 63
- 38
- 46
- 223
- 212
- 186
- 247
- 247
- 247
Releases
2 of 3 checks-
Yes: A release in the last 365 days
Newest release action-v0.10.0 on 2026-11-12, 0 days ago. 10 or more releases in the last 365 days. Source
-
No: The newest release tag is a semantic version
The newest release tag is action-v0.10.0. Source
-
Yes: A changelog file at the root
CHANGELOG.md at the root (GitHub, 2026-11-12). Source
Security practice
1 of 1 check-
Yes: A security policy
GitHub finds a security policy (GitHub, 2026-11-12). Source
OpenSSF Scorecard has no result for this repository from the last 90 days.
Community files
2 of 3 checksDependencies in the index
This section shows the packages that connect this repository to other repositories in the index.
The GitHub dependency graph of this repository names 236 direct packages (scanned on Nov 12, 2026). Packages from 31 other repositories in the index are among them.
2 scanned repositories name a package from this repository.
Uses (in the index) · 31
- react/react 253K
npm: react
- openai/codex 135K
GitHub Actions: openai/codex/.github/actions/setup-akv-pkcs11-codesigning
npm: @openai/codex, @openai/codex-sdk
PyPI: openai-codex, openai-codex-cli-bin
- microsoft/TypeScript 112K
npm: @typescript/typescript-aix-ppc64, @typescript/typescript-darwin-arm64, @typescript/typescript-darwin-x64, @typescript/typescript-freebsd-arm64 and 17 more
- mozilla/pdf.js 54K
npm: pdfjs-dist
-
npm: prettier
-
npm: @types/bun, @types/node, @types/papaparse, @types/react and 2 more
- astral-sh/ruff 51K
PyPI: ruff
- colinhacks/zod 44K
npm: zod
- vadimdemedes/ink 40K
npm: ink
- evanw/esbuild 40K
npm: @esbuild/aix-ppc64, @esbuild/android-arm, @esbuild/android-arm64, @esbuild/android-x64 and 23 more
Show all 31
-
PyPI: pydantic
-
npm: promptfoo
-
npm: @inquirer/checkbox, @inquirer/confirm, @inquirer/input, @inquirer/search
-
npm: graphql
-
npm: ajv
-
PyPI: pytest
-
npm: @modelcontextprotocol/sdk
- mholt/PapaParse 14K
npm: papaparse
-
Cargo: windows-link, windows-sys
-
GitHub Actions: actions/checkout
-
Cargo: napi, napi-build, napi-derive, napi-derive-backend and 1 more
- json5/json5 7.2K
npm: json5
- rust-lang/futures-rs 5.9K
Cargo: futures, futures-channel, futures-core, futures-executor and 5 more
- actions/toolkit 5.9K
npm: @actions/artifact, @actions/core, @actions/io
- npm/node-semver 5.5K
npm: semver
-
PyPI: jsonschema
-
npm: @stryker-mutator/core
- yaml/pyyaml 3K
PyPI: pyyaml
-
npm: yauzl
-
npm: string-width
- chalk/strip-ansi 499
npm: strip-ansi
Used by (in the index) · 2
-
npm: @openai/codex-security
-
npm: @openai/codex-security
Sources: the GitHub dependency graph of each repository, and deps.dev for the source repository of each package (checked on Nov 12, 2026). A dependency graph also names development packages. deps.dev takes most source repositories from package metadata. How the dependency graph is made
Observations
Latest Observation, Nov 12, 2026: 11,698 stars, 937 forks, last push Nov 12, 2026, not archived. One of 2 Observations since Nov 11, 2026.