openai/codex-security is a command-line tool (CLI) and TypeScript SDK that finds, investigates, and fixes vulnerabilities in code repositories. It scans an entire repository, a given path, or code changes, verifies the candidates it finds, and then produces fix proposals or confirms existing fixes. The latest release tag recorded in FACTS is npm-v0.7.0, and the package is @openai/codex-security. However, the specific changes in this version are not included in the provided information, so it is not possible to confirm what was newly added or changed.
The tool is used to automate security reviews. Beyond vulnerability scanning, it supports threat modeling, drafting security policies, duplicate detection, and severity classification. It can pull in security advisories and export results, and it also supports continuous integration tasks and scanning multiple repositories. It is written in TypeScript and uses the Apache-2.0 license. Its scope therefore goes beyond reviewing a single code change and extends to repository-wide reviews and the handling of results.
The provided information contains neither a changelog nor benchmark results for npm-v0.7.0. What the tool handles are vulnerability candidates that still require verification, so results should go through a verification step rather than be treated as confirmed vulnerabilities. On the currently verifiable evidence alone, it is difficult to judge detection performance or the extent of the improvements in this version.