Codex Security plugin quickstart
Codex Security scans your code for vulnerabilities and validates plausible findings. For each reportable issue, it gives you the evidence and remediation guidance you need to review the result. Scan only code you own or have permission to assess.
Follow this quickstart to install the plugin and run a read-only scan of a local repository in Codex.
This page covers the plugin that runs in a local Codex chat. To scan a connected GitHub repository in Codex cloud, see Codex Security cloud setup.
Install the plugin
-
Open the repository you want to assess in Codex in the ChatGPT desktop app.
-
Open Plugins, search for Codex Security, or use the button below:
Install the Codex Security plugin -
Start a new Codex chat for that repository. Don't continue an existing chat.
The hosted desktop-app catalog and public Codex CLI marketplace can offer different plugin versions. Check the plugin changelog before you rely on a feature or start a long-running scan.
Run your first scan
For the best scan quality, use gpt-5.6-sol
with xhigh reasoning effort.
<VideoPlayer src="/videos/codex/security/scan-setup-to-findings.mp4" poster="/videos/codex/security/scan-setup-to-findings-poster.webp" />
-
Ask for an ordinary scan
Send this prompt in the new chat:
Run a Codex Security scan on this repository. -
Confirm the setup
Codex opens a setup workspace before it starts. For your first run, use these settings:
- Scan type:
Codebase - Deep scan: Off
- Scan area:
Entire codebase - Threat model scoping guidance: Leave blank unless you already know a specific attack vector or application area that deserves priority.
Confirm that Codebase, Current branch, and Last commit identify the repository you intended to scan. Then select Start scan.
Configure the scan target, scan area, branch, and optional threat model guidance before starting the scan. - Scan type:
-
Let the scan finish
Keep the scan running until the workspace reports that it is complete. If Codex identifies a configuration limitation, review the limitation and the exact proposed change before you approve a configuration update.
-
Review the result
Use the UI to browse findings, or open
report.mdas the entry point to the complete scan directory.Browse findings by severity, category, directory, patch status, and review status.
What the scan creates
Every completed scan opens a findings workspace. Use it to review findings and coverage without inspecting raw artifacts. The scan also creates the files below.
report.md, the primary readable entry point to the scan results.findings/<slug>/, with one detailed vulnerability report per reportable finding and supporting proof-of-concept files when available.hardening/, with a structural hardening portfolio and supporting proposals or diagrams when the scan has reportable findings.- Structured scan data in
scan-manifest.json,findings.json, andcoverage.jsonfor automation and integrations. You normally don't need to open these files yourself.
Keep the full scan directory together when sharing or archiving results so the
links from report.md continue to work.
Choose your next workflow
- Run a standard or scoped scan to review a repository or one folder with the default workflow.
- Run a deep scan for a more thorough scan when you can allow for a longer runtime.
- Review code changes to assess a pull request, commit, branch range, or working-tree patch.
- Triage a backlog to review existing security findings.
- Fix and verify a finding after you accept one finding for remediation.
- Export or track findings to create JSON, CSV, SARIF, an approval-gated Linear, GitHub, or Jira issue, or a private draft GitHub Security Advisory.
- Write vulnerability reports to turn supplied findings, disclosure notes, source, and PoCs into self-contained reports.
- Propose security hardening to consider structural or architectural options based on scan results or other security evidence.