# OpenAI Codex Security for Codex

> Fork a Codex microVM with OpenAI's security CLI + skill pack installed. Dry-run first. Your keys. Your findings.

- Agent: Codex CLI
- Plan: Starter (1 vCPU, 2 GiB RAM, 10 GiB disk)
- Forks: 0 · Stars: 0
- Creator: https://www.jurniti.com/creator-ca0ff2
- Tags: appsec, codex, openai, sarif, sast, security
- Requires config (you provide): OPENAI_API_KEY

**To fork:** open https://www.jurniti.com/templates/openai-codex-security-for-codex and use the Fork action — it starts a Stripe Checkout for a new VM seeded with this template's persist disk (same flat plan price, no fork fee).

## README

# Scan the repo. Keep the findings. Own the box.

OpenAI shipped **Codex Security** — an open-source CLI and skill pack to scan
repositories, track findings across runs, verify fixes, and add security checks
to CI. HN found it before the formal announce. This template is the version that
does not make you install it.

You fork a **managed Codex microVM** on jurniti. The CLI is already on your PATH.
The OpenAI plugin skills are already under `~/.codex/skills/codex-security/`.
You add **your** OpenAI auth. You scan.

## The 60-second demo

```bash
export PATH="$HOME/.local/bin:$PATH"
codex-security --help

# Your credentials only (never baked into the template):
#   export OPENAI_API_KEY=…     or
#   codex-security login --device-auth

codex-security scan ~/.codex/skills/codex-security/samples/tiny-app --dry-run
codex-security scan /path/to/your/repo --max-cost 5 --output-dir ~/scans/demo
codex-security export ~/scans/demo --export-format sarif --output ~/scans/demo.sarif
```

That dry-run path is how you confirm the toolchain before you spend model budget.

## What lands in your fork

| You get | Where |
| --- | --- |
| CLI wrapper | `~/.local/bin/codex-security` |
| Pinned package `@openai/codex-security@0.1.1` | `~/.codex/skills/codex-security-cli/` |
| OpenAI skill pack (scan, diff-scan, deep scan, threat model, triage, fix, write-up, …) | `~/.codex/skills/codex-security/skills/` |
| Prompts | `/security-scan`, `/security-diff-scan`, `/codex-security` |
| Sample naive app (demo only) | `~/.codex/skills/codex-security/samples/tiny-app` |

## Auth (BYOK)

1. Open the Codex terminal on jurniti.
2. Export `OPENAI_API_KEY` (or `CODEX_API_KEY`) in the shell, **or** run
   `codex-security login --device-auth` for headless ChatGPT sign-in.
3. Optionally `codex login --device-auth` for the Codex agent itself.

Keys stay on **your** VM. Do not paste secrets into skills, prompts, or `AGENTS.md`.

## Rules that keep you out of trouble

1. **Dry-run first** when cost is unclear (`--dry-run`, keep `--max-cost` set).
2. **Verify every finding in source** before you file issues or PR comments.
3. **Never auto-merge.** Never open public advisories from the agent alone.
4. Write outputs under `~/scans/` — outside the target repository.

## Who should fork this

**Yes:** AppSec engineers, security-minded founders, eng leads who want OpenAI’s
Codex Security toolchain on an isolated paid box today.

**No:** Teams that want a no-login SaaS scanner with no agent, or anyone who
expects the agent to merge “fixes” without a human.

## Lineage

- Upstream: [github.com/openai/codex-security](https://github.com/openai/codex-security) (Apache-2.0)
- NPM: [@openai/codex-security](https://www.npmjs.com/package/@openai/codex-security)
- Docs: [developers.openai.com/codex/security](https://developers.openai.com/codex/security)
- OpenAI announce (quote-tweet target): [x.com/OpenAI/status/2082263717916586117](https://x.com/OpenAI/status/2082263717916586117)

jurniti is the microVM. OpenAI is the tool. You own both after you fork.