About this template

Scan the repo. Keep the findings. Own the box.

OpenAI shipped Codex Security — an open-source CLI and skill pack to scan repositories, track findings across runs, verify fixes, and add security checks to CI. HN found it before the formal announce. This template is the version that does not make you install it.

You fork a managed Codex microVM on jurniti. The CLI is already on your PATH. The OpenAI plugin skills are already under ~/.codex/skills/codex-security/. You add your OpenAI auth. You scan.

The 60-second demo

export PATH="$HOME/.local/bin:$PATH"
codex-security --help

# Your credentials only (never baked into the template):
#   export OPENAI_API_KEY=…     or
#   codex-security login --device-auth

codex-security scan ~/.codex/skills/codex-security/samples/tiny-app --dry-run
codex-security scan /path/to/your/repo --max-cost 5 --output-dir ~/scans/demo
codex-security export ~/scans/demo --export-format sarif --output ~/scans/demo.sarif

That dry-run path is how you confirm the toolchain before you spend model budget.

What lands in your fork

You get	Where
CLI wrapper	`~/.local/bin/codex-security`
Pinned package `@openai/codex-security@0.1.1`	`~/.codex/skills/codex-security-cli/`
OpenAI skill pack (scan, diff-scan, deep scan, threat model, triage, fix, write-up, …)	`~/.codex/skills/codex-security/skills/`
Prompts	`/security-scan`, `/security-diff-scan`, `/codex-security`
Sample naive app (demo only)	`~/.codex/skills/codex-security/samples/tiny-app`

Auth (BYOK)

Open the Codex terminal on jurniti.
Export OPENAI_API_KEY (or CODEX_API_KEY) in the shell, or run codex-security login --device-auth for headless ChatGPT sign-in.
Optionally codex login --device-auth for the Codex agent itself.

Keys stay on your VM. Do not paste secrets into skills, prompts, or AGENTS.md.

Rules that keep you out of trouble

Dry-run first when cost is unclear (--dry-run, keep --max-cost set).
Verify every finding in source before you file issues or PR comments.
Never auto-merge. Never open public advisories from the agent alone.
Write outputs under ~/scans/ — outside the target repository.

Who should fork this

Yes: AppSec engineers, security-minded founders, eng leads who want OpenAI’s Codex Security toolchain on an isolated paid box today.

No: Teams that want a no-login SaaS scanner with no agent, or anyone who expects the agent to merge “fixes” without a human.

Lineage

Upstream: github.com/openai/codex-security (Apache-2.0)
NPM: @openai/codex-security
Docs: developers.openai.com/codex/security
OpenAI announce (quote-tweet target): x.com/OpenAI/status/2082263717916586117

jurniti is the microVM. OpenAI is the tool. You own both after you fork.

Inside this fork

Forking copies this template into a brand-new, fully isolated microVM on your own subdomain. Here's exactly what lands in it.

Codex CLI agent
The upstream harness, pre-installed — same version the creator ran.
Starter VM
1 vCPU · 2 GiB RAM · 10 GiB disk.
Creator's /persist data
The captured persist volume is copied byte-for-byte into your fork.
BYOK — your keys, your VM
Add your model API keys after forking; they live only inside your microVM.

What you'll configure after forking

Secrets are scrubbed from shared templates — these are the names you supply in your agent's terminal once it boots.

Environment variables

OPENAI_API_KEY

Your own OpenAI Codex Security for Codex, live in about 3 minutes.

Forking copies this Codex CLIagent into a brand-new, fully isolated microVM on your own subdomain — the creator's /persist state and all. Add your own keys after it boots; they never leave the box. Don't love it? Your first jurniti purchase comes with 30 days to get every cent back.

New paid VM · BYOK · 30-day money-back on your first purchase · ~3 min to provision

OpenAI Codex Security for Codex

What's inside