Codex Security plugin quickstart
Codex Security is a security-review plugin for Codex that scans your code for vulnerabilities, validates plausible findings, and presents evidence and remediation guidance in a reviewable workspace. Use it to find security issues in code you own or have authorization to assess before they reach production.
This quickstart takes you through one recommended first run: an ordinary, read-only scan of a local repository in Codex.
This page covers the plugin that runs in a local Codex task. To scan a connected GitHub repository in Codex cloud, see Codex Security cloud setup.
Install the plugin
-
Open the repository you want to assess in Codex in the ChatGPT desktop app.
-
Go to Plugins and search for Codex Security, or select the button below:
Install the Codex Security plugin -
Start a new task in Codex for that repository (don't continue in a task that was already open).
Run your first scan
For the best scan quality, use gpt-5.6
with high or xhigh reasoning effort.
<VideoPlayer src="/videos/codex/security/scan-setup-to-findings.mp4" poster="/videos/codex/security/scan-setup-to-findings-poster.webp" />
-
Ask for an ordinary scan
Send this prompt in the new task:
Run a Codex Security scan on this repository. -
Confirm the setup
Codex opens a setup workspace before it starts. For your first run, use these settings:
- Scan type:
Codebase - Deep scan: Off
- Scan area:
Entire codebase - Threat model scoping guidance: Leave blank unless you already know a specific attack vector or application area that deserves priority.
Confirm that Codebase, Current branch, and Last commit identify the repository you intended to scan. Then select Start scan.
Configure the scan target, scan area, branch, and optional threat model guidance before starting the scan. - Scan type:
-
Let the scan finish
The scan can take time. Keep the task running until the workspace reports completion. If Codex identifies a configuration limitation, review the exact limitation and proposed change before allowing it to update your configuration.
-
Review the result
Use the UI to browse findings or open the generated report for a complete, portable review.
Browse findings by severity, category, directory, patch status, and review status.
What the scan creates
Every completed scan opens a findings workspace. Use it to review findings and coverage without inspecting raw artifacts. The scan also creates the files below.
report.md, a complete portable report for sharing or archiving.- Structured scan data in
scan-manifest.json,findings.json, andcoverage.jsonfor automation and integrations. You normally don't need to open these files yourself.
Choose your next workflow
- Run a standard or scoped scan when you want to scan a repository or one folder with the default workflow.
- Run a deep scan when you need a more comprehensive scan and can wait longer for it to finish.
- Review code changes when the target is a pull request, commit, branch range, or working-tree patch.
- Triage a backlog when you have existing security findings to review.
- Fix and verify a finding after you accept one finding for remediation.
- Export or track findings when you need JSON, CSV, SARIF, an approval-gated Linear, GitHub, or Jira issue, or a private draft GitHub Security Advisory.