OpenAI's Codex Security, the application-security agent that builds a codebase-specific threat model and flags issues, picked up a GitLab integration in beta this month, adding to its existing GitHub support. On its own that's a fairly small feature note. What it signals is more interesting than the feature itself.
What Codex Security actually does
Since entering research preview earlier this year, Codex Security has scanned well over a million commits and flagged a large number of critical and high-severity issues, by OpenAI's own reported figures. It's built specifically to understand a given codebase's own structure and flag issues against that context, rather than running one generic rule set against everything.
Why the platform expansion matters more than it looks like it should
A tool that only works where your code happens to live is a tool a lot of teams simply can't use, regardless of how good it is. Following developers to a second major platform is a quiet admission that this kind of scanning is expected to become a baseline expectation, not a GitHub-specific perk. That's a meaningfully different posture than treating security scanning as one platform's differentiator.
The pattern this fits into
This is part of a broader shift that's been building for a while: AI coding tools and the platforms around them adding their own security checks as a built-in expectation rather than an optional extra, following genuinely serious incidents across several popular tools over the past year. That's real progress, and worth acknowledging as such.
What it doesn't change
A scanner that understands your codebase still can't verify your live production database's access rules, or confirm that a third-party service you've connected is configured the way you think it is on its own end. Code-level scanning and infrastructure-level configuration are different problems, and expanding to a second platform doesn't close that particular gap. Worth celebrating the direction here, while still being precise about what any single tool, on any platform, actually covers.