Codex Security

For a prescriptive first local scan, start with the Codex Security plugin quickstart.

Explore plugin use cases

Run a security scan for a repository or one scoped folder.
Run a deep security scan when you need a more comprehensive scan and can wait longer for it to finish.
Review code changes before you merge a pull request or branch.
Triage a backlog when you have existing security findings to review.
Fix and verify findings with bounded patches for approved findings.
Export or track findings as portable artifacts or approval-gated tracking destinations.
See what's new in the Codex Security plugin.

The plugin runs in your Codex task. Codex Security cloud scans connected GitHub repositories through Codex cloud. For Codex sandboxing, approvals, network controls, and admin settings, see Agent approvals & security.

Codex Security cloud

Codex Security cloud is currently in research preview. It scans connected GitHub repositories for likely security issues.

It helps teams:

Find likely vulnerabilities by using a repo-specific threat model and real code context.
Reduce noise by validating findings before you review them.
Move findings toward fixes with ranked results, evidence, and suggested patch options.

How Codex Security cloud works

Codex Security scans connected repositories commit by commit. It builds scan context from your repo, checks likely vulnerabilities against that context, and validates high-signal issues in an isolated environment before surfacing them.

You get a workflow focused on:

repo-specific context instead of generic signatures
validation evidence that helps reduce false positives
suggested fixes you can review in GitHub

Codex Security cloud access and prerequisites

Codex Security cloud works with connected GitHub repositories through Codex cloud. If a repository isn't visible, confirm the repository is available in your Codex cloud workspace or contact your OpenAI account team.

Codex Security plugin quickstart walks through installation and a first local scan.
Codex Security cloud setup details setup, scanning, and findings review.
Improving the threat model explains how to tune scope, attack surface, and criticality assumptions.
FAQ covers common product questions.

security.md +19 −17

2 2

3<CtaPillLink3<CtaPillLink

4 href="https://chatgpt.com/plugins/share/676aca3811d54fa7bcdef5255236b3c4"4 href="https://chatgpt.com/plugins/share/676aca3811d54fa7bcdef5255236b3c4"

~~5 label="Install plugin in Codex App"~~5 label="Install plugin in ChatGPT"

6 icon="external"6 icon="external"

7 class="my-8"7 class="my-8"

8/>8/>

9 9

10For a prescriptive first local scan, start with the [Codex Security plugin10For a prescriptive first local scan, start with the [Codex Security plugin

~~11quickstart](https://developers.openai.com/codex/security/plugin).~~11quickstart](https://learn.chatgpt.com/docs/security/plugin).

12 12

13### Explore plugin use cases13### Explore plugin use cases

14 14

~~15- [Run a security scan](https://developers.openai.com/codex/security/plugin/scans) for a repository or one scoped folder.~~15- [Run a security scan](https://learn.chatgpt.com/docs/security/plugin/scans) for a repository or one scoped folder.

~~16- [Run a deep security scan](https://developers.openai.com/codex/security/plugin/deep-scans) when you need a more comprehensive scan and can wait longer for it to finish.~~16- [Run a deep security scan](https://learn.chatgpt.com/docs/security/plugin/deep-scans) when you need a more comprehensive scan and can wait longer for it to finish.

~~17- [Review code changes](https://developers.openai.com/codex/security/plugin/code-changes) before you merge a pull request or branch.~~17- [Review code changes](https://learn.chatgpt.com/docs/security/plugin/code-changes) before you merge a pull request or branch.

~~18- [Triage a backlog](https://developers.openai.com/codex/security/plugin/triage-backlog) when you have existing security findings to review.~~18- [Triage a backlog](https://learn.chatgpt.com/docs/security/plugin/triage-backlog) when you have existing security findings to review.

~~19- [Fix and verify findings](https://developers.openai.com/codex/security/plugin/fix-findings) with bounded patches for approved findings.~~19- [Fix and verify findings](https://learn.chatgpt.com/docs/security/plugin/fix-findings) with bounded patches for approved findings.

~~20- [Export or track findings](https://developers.openai.com/codex/security/plugin/export-findings) as portable artifacts or approval-gated tracking destinations.~~20- [Export or track findings](https://learn.chatgpt.com/docs/security/plugin/export-findings) as portable artifacts or approval-gated tracking destinations.

~~21- [See what's new](https://developers.openai.com/codex/security/plugin/changelog) in the Codex Security plugin.~~21- [See what's new](https://learn.chatgpt.com/docs/security/plugin/changelog) in the Codex Security plugin.

22 22

~~23The plugin runs in your Codex thread. Codex Security cloud scans connected~~23The plugin runs in your Codex task. Codex Security cloud scans connected

~~24 GitHub repositories through Codex Web. For Codex sandboxing, approvals,~~24 GitHub repositories through Codex cloud. For Codex sandboxing, approvals,

25 network controls, and admin settings, see [Agent approvals &25 network controls, and admin settings, see [Agent approvals &

~~26 security](https://developers.openai.com/codex/agent-approvals-security).~~26 security](https://learn.chatgpt.com/docs/agent-approvals-security).

27 27

28## Codex Security cloud28## Codex Security cloud

29 29

49 49

50## Codex Security cloud access and prerequisites50## Codex Security cloud access and prerequisites

51 51

52Codex Security is available for ChatGPT Enterprise, Edu, Business, and Pro users. It works with connected GitHub repositories through Codex Web. If you need access or a repository isn't visible, confirm the repository is available through your Codex Web workspace or contact your OpenAI account team.52Codex Security cloud works with connected GitHub repositories through Codex

53cloud. If a repository isn't visible, confirm the repository is available in your

54Codex cloud workspace or contact your OpenAI account team.

53 55

54## Related docs56## Related docs

55 57

~~56- [Codex Security plugin quickstart](https://developers.openai.com/codex/security/plugin) walks through installation and a first local scan.~~58- [Codex Security plugin quickstart](https://learn.chatgpt.com/docs/security/plugin) walks through installation and a first local scan.

~~57- [Codex Security cloud setup](https://developers.openai.com/codex/security/setup) details setup, scanning, and findings review.~~59- [Codex Security cloud setup](https://learn.chatgpt.com/docs/security/setup) details setup, scanning, and findings review.

~~58- [Improving the threat model](https://developers.openai.com/codex/security/threat-model) explains how to tune scope, attack surface, and criticality assumptions.~~60- [Improving the threat model](https://learn.chatgpt.com/docs/security/threat-model) explains how to tune scope, attack surface, and criticality assumptions.

~~59- [FAQ](https://developers.openai.com/codex/security/faq) covers common product questions.~~61- [FAQ](https://learn.chatgpt.com/docs/security/faq) covers common product questions.