Run a deep security scan
Run a deep scan when you need a more thorough review and can allow for a longer runtime. Deep scans search a repository more extensively and can reduce variability between runs.
Start with a standard scan to check your scope and results. Then use a deep scan when you need a more thorough assessment.
Choose between standard and deep scans
| Standard scan | Deep scan | |
|---|---|---|
| Best for | First runs and routine repository or folder review | More thorough reviews after a standard scan |
| Variability | Standard | Reduced |
| Scope | Repository or explicit folder | Repository or explicit folder |
| Runtime and resources | Lower | Higher |
| Pull requests and diffs | Use the change-review workflow | Not supported; use the change-review workflow instead |
Start the deep scan
For a repository-wide review, send:
Use $codex-security:deep-security-scan to run a deep security scan of this repository.
For one component in a monorepo, identify the folder explicitly:
Use $codex-security:deep-security-scan to run a deep security scan of /absolute/path/to/repository/services/payments.
For a scoped deep scan in the ChatGPT desktop app, the selected folder becomes the Codebase. The scan area covers the entire selected folder.
Confirm setup and preflight
- Confirm Scan type is
Codebaseand Deep scan is on. - Confirm that Codebase is the repository or exact folder you intended to scan.
- Add threat-model guidance only for concrete attack vectors, sensitive application areas, or repository context that the code can't reveal.
- Select Start scan.
- Review the capability preflight. If it proposes a configuration change, review the exact change and let Codex apply it only if it matches your environment. Start a new chat if Codex tells you a restart is required.
Deep scans require delegated workers and at least six usable worker slots. If the current runtime doesn't meet those requirements, use a standard scan or move the task to a runtime that passes the capability preflight.
On supported desktop-app versions, discovery workers inherit your selected model and reasoning settings. Keep the scan active until Codex reports that it is complete. Reopening or rerunning a saved scan doesn't pin the plugin version or guarantee that work interrupted by an update will resume. Check the plugin changelog before you update the plugin or start another deep scan.
<VideoPlayer src="/videos/codex/security/deep-scan-progress.mp4" poster="/videos/codex/security/deep-scan-progress-poster.webp" />
Review the result
Deep scans use the same findings workspace and complete scan directory as
standard scans. Start with report.md, which links to one detailed report for
each reportable finding and a structural hardening portfolio when findings
remain. Keep the linked findings/ and hardening/ directories with the
report when sharing or archiving the result.
Review the coverage summary before the findings. Even a deep scan has limits, so check deferred surfaces and remaining proof gaps before drawing a conclusion. For a finding you accept, continue with Fix and verify a finding.
To review a pull request, commit, branch range, or local patch, use Review code changes. A deep scan never substitutes for the diff-focused workflow.