SpyBara
Go Premium

use-cases/deep-security-scan.md 2026-05-27 00:57 UTC to 2026-05-28 18:58 UTC

131 added, 0 removed.

2026
Sat 30 07:08 Fri 29 18:58 Thu 28 18:58 Wed 27 00:57 Tue 26 18:54 Sat 23 00:54 Fri 22 18:42 Thu 21 18:44 Wed 20 00:58 Tue 19 18:43 Mon 18 22:01 Thu 14 21:00 Wed 13 00:57 Tue 12 01:59 Mon 11 18:00 Thu 7 20:02 Tue 5 23:00 Sat 2 06:45 Fri 1 18:29

Run a deep security scan | Codex use cases

Codex use cases

Codex

Codex use case

Run a deep security scan

Search an authorized repository deeply for plausible vulnerabilities.

Difficulty Advanced

Time horizon Long-running

Use the Codex Security plugin to run a higher-recall, repository-wide audit that repeats discovery, validates candidates, and produces reviewable report artifacts.

Best for

  • Application security reviews of a complete repository that you own or are authorized to assess.
  • High-recall reviews where additional runtime and token use are appropriate for finding more candidate issues.
  • Security teams that need traceable finding evidence before deciding what to remediate.

Contents

← All use cases

Copy page Export as PDF

Use the Codex Security plugin to run a higher-recall, repository-wide audit that repeats discovery, validates candidates, and produces reviewable report artifacts.

Advanced

Long-running

Related links

Codex Security plugin Agent approvals and security Codex cyber safety

Best for

  • Application security reviews of a complete repository that you own or are authorized to assess.
  • High-recall reviews where additional runtime and token use are appropriate for finding more candidate issues.
  • Security teams that need traceable finding evidence before deciding what to remediate.

Skills & Plugins

  • Codex Security:deep Security Scan

    Run repeated repository-wide security discovery passes, validate surviving findings, analyze attack paths, and create reviewable reports.

Skill Why use it
Codex Security:deep Security Scan Run repeated repository-wide security discovery passes, validate surviving findings, analyze attack paths, and create reviewable reports.

Starter prompt

/goal Run a deep security scan on this repository. Do not stop until all required steps are complete and the final report is ready. Scope and rules:

  • I am authorized to assess this repository.
  • Treat the entire repository as in scope.
  • Use the Codex Security plugin's deep scan workflow; do not broaden this into a diff or scoped-path review.
  • Keep the scan read-only; do not modify code, open pull requests, or test external targets. Return the final Markdown and HTML report paths and summarize the findings that require human review first.

Open in the Codex app

/goal Run a deep security scan on this repository. Do not stop until all required steps are complete and the final report is ready. Scope and rules:

  • I am authorized to assess this repository.
  • Treat the entire repository as in scope.
  • Use the Codex Security plugin's deep scan workflow; do not broaden this into a diff or scoped-path review.
  • Keep the scan read-only; do not modify code, open pull requests, or test external targets. Return the final Markdown and HTML report paths and summarize the findings that require human review first.

Choose a deep repository review

Use a deep scan when you need high-recall vulnerability discovery across a complete repository and can budget for a longer run. The Codex Security plugin repeats discovery passes before validating and prioritizing findings, so this workflow takes more time and tokens than an ordinary scan.

A deep scan is for an entire repository. To review one package or directory, use $codex-security:security-scan. To review a pull request, commit, branch diff, or working-tree patch, use $codex-security:security-diff-scan.

Prepare an authorized scan

  1. Open the repository in Codex and install the Codex Security plugin.
  2. Confirm that you own the repository or have authorization to assess it.
  3. Add repository-specific architecture, trust-boundary, build, test, and validation guidance in AGENTS.md when it will improve the review.
  4. Run the starter prompt and let the scan complete its repeated discovery, validation, attack-path analysis, and final reporting stages.
  5. Review the final reports before asking Codex to change code or reproduce a finding further.

Review evidence before remediation

The final result should identify affected locations, why the behavior is reachable, what validation Codex performed, any remaining proof gaps, and a bounded remediation direction. Distinguish findings without validation evidence from validated findings.

Start remediation only for a finding you have selected and reviewed. Use Remediate a vulnerability backlog to fix findings one at a time with focused regression validation.

[

Scan code changes for security

Use the Codex Security plugin to examine a Git-backed change set, validate plausible...

Engineering Quality](https://developers.openai.com/codex/use-cases/scan-code-changes-for-security)[

Add evals to your AI application

Ask Codex to inspect your AI application, identify the behavior you want to evaluate, and...

Evaluation Quality](https://developers.openai.com/codex/use-cases/ai-app-evals)[

Audit dependency incidents

Use Codex to turn a public package or supply chain advisory into a read-only audit, then...

Engineering Quality](https://developers.openai.com/codex/use-cases/dependency-incident-audits)