Codex Security
For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending
.mdto the page URL.
Codex Security is an application security agent that helps security and engineering teams find, confirm, and fix vulnerabilities. Use it in Codex, from your terminal, through the TypeScript SDK, or with connected GitHub repositories.
<CtaPillLink href="https://chatgpt.com/plugins/share/676aca3811d54fa7bcdef5255236b3c4" label="Install plugin in ChatGPT" icon="external" class="mb-8 mt-2" />
For a prescriptive first local scan, start with the Codex Security plugin quickstart.
Explore plugin use cases
- Run a security scan for a repository or one scoped folder.
- Run a deep security scan when you need broader review and can wait longer for it to finish.
- Review code changes before you merge a pull request or branch.
- Triage a backlog when you have existing security findings to review.
- Fix and verify findings with bounded patches for approved findings.
- Export or track findings as portable artifacts or approval-gated tracking destinations.
- Write vulnerability reports from supplied findings, disclosure notes, source, and PoCs.
- Propose security hardening from scan results or other security evidence.
- See what's new in the Codex Security plugin.
The plugin runs in your Codex chat. Codex Security cloud scans connected GitHub repositories through Codex cloud. For Codex sandboxing, approvals, network controls, and admin settings, see Agent approvals & security.
Codex Security CLI and SDK
The Codex Security CLI and SDK are in limited beta and available only to approved customers and partners. Contact your account team for access.
Use the same scanner as the plugin across repositories and over time. The CLI discovers GitHub repositories, resumes bulk scans, tracks findings across scans, and records false-positive feedback. Add your architecture and security policies, set an estimated cost limit, or run checks in CI and before commits. Use the TypeScript SDK to build scanning, progress reporting, and cost controls into an application or developer tool.
- Start with the CLI quickstart to set up the CLI, preflight a repository, and run a local scan.
- Run bulk security scans to discover GitHub repositories or run a resumable campaign from a CSV inventory.
- Run scans in CI to review pull-request changes, preserve artifacts, upload SARIF, and set a severity policy.
- Read the CLI FAQ for answers about scan history, false-positive feedback, coverage, and fix verification.
- Use the CLI reference to check supported commands, flags, output formats, artifacts, and exit codes.
- Integrate the TypeScript SDK to select targets, inspect results, track progress, and cancel scans from code.
Codex Security cloud
Codex Security cloud is currently in research preview. It scans connected GitHub repositories for likely security issues.
It helps teams:
- Find likely vulnerabilities by using a repo-specific threat model and real code context.
- Reduce noise by validating findings before you review them.
- Move findings toward fixes with ranked results, evidence, and suggested patch options.
How Codex Security cloud works
Codex Security scans connected repositories commit by commit. It builds scan context from your repo, checks likely vulnerabilities against that context, and validates high-signal issues in an isolated environment before surfacing them.
You get a workflow focused on:
- repo-specific context instead of generic signatures
- validation evidence that helps reduce false positives
- suggested fixes you can review in GitHub
Codex Security cloud access and prerequisites
Codex Security cloud works with connected GitHub repositories through Codex cloud. If a repository isn't visible, confirm the repository is available in your Codex cloud workspace or contact your OpenAI account team.
Related docs
- Codex Security plugin quickstart walks through installation and a first local scan.
- Codex Security CLI quickstart walks through setup, preflight, and a first terminal scan.
- Run bulk security scans explains GitHub discovery, CSV inventories, campaign results, and resume behavior.
- Codex Security CLI FAQ answers common questions about scans, findings, coverage, and costs.
- Codex Security TypeScript SDK explains how to run scans from an application or developer tool.
- Codex Security cloud setup details setup, scanning, and findings review.
- Improving the threat model explains how to tune scope, entry points, and criticality assumptions.
- Codex Security cloud FAQ covers common cloud product questions.