Codex Security plugin quickstart
For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending
.mdto the page URL.
Codex Security scans your code for vulnerabilities and validates plausible findings. For each reportable issue, it gives you the evidence and remediation guidance you need to review the result. Scan only code you own or have permission to assess.
Follow this quickstart to install the plugin and run a read-only scan of a local repository in Codex.
This page covers the Codex Security plugin in the desktop app or Codex CLI. To scan a connected GitHub repository in Codex cloud, see Codex Security cloud setup.
Install the plugin
-
Open Plugins, search for Codex Security, or use the button below:
<ButtonLink href="codex://plugins/install/codex-security?marketplace=openai-curated" color="primary" variant="solid" size="lg" pill
Install the Codex Security plugin -
Confirm the plugin is enabled, then open Security in the sidebar.
- In your terminal, go to the repository you want to assess and start Codex:
codex
- Enter
/plugins, search for Codex Security, and select Install plugin. - Enter
/newto start a new chat for the repository.
The hosted desktop-app catalog and public Codex CLI marketplace can offer different plugin versions. Check the plugin changelog before you rely on a feature or start a long-running scan. If Security doesn't appear in the desktop-app sidebar, update the app and plugin and confirm that the plugin is enabled.
Run your first scan
For the best scan quality, use gpt-5.6-sol
with xhigh reasoning effort.
-
Open the scan setup
Select Security in the sidebar, open Scans, and select + Scan.
-
Choose the codebase and scan area
Select an existing repository or use another folder. Choose Codebase, leave Deep scan off, and select the entire repository or one folder. Confirm that the branch and revision identify the code you intended to scan.
-
Add relevant context
Choose the model and reasoning effort. Open Additional context only when you need to describe a specific attack vector, security-sensitive area, or repository detail that should guide the review.
Turn on additional context to describe attack vectors, focus areas, and relevant security guidance. -
Start the scan
Select Start scan and follow the scan phases in the Security workbench. Select View activity to inspect the Codex task that performs the scan.
-
Review the result
Open the completed scan to inspect findings, coverage, and available report artifacts. Use Findings to review issues across scans or Repositories to inspect a repository's scan history.
Review scan results, findings, and coverage in the Security workbench.
-
Ask for an ordinary scan
Send this prompt in the new chat:
Run a Codex Security scan on this repository.
-
Let the scan finish
Codex runs the scan in the terminal without opening a setup workspace. Keep the task running until Codex reports that it is complete. If Codex identifies a configuration limitation, review the limitation and the exact proposed change before you approve a configuration update.
-
Review the result
Review the summary in the terminal, then open the generated
report.mdfor the complete result.
What the scan creates
Completed scans remain available in Scans. Review their findings and coverage in the Security workbench, or inspect related findings and repository history in Findings and Repositories. The scan also creates the files below.
Every completed scan reports a summary in the terminal and creates the files below.
report.md, the primary readable entry point to the scan results.findings/<slug>/, when detailed vulnerability reports and supporting proof-of-concept files are available.hardening/, when structural hardening guidance and supporting proposals or diagrams are available.- Structured scan data in
scan-manifest.json,findings.json, andcoverage.jsonfor automation and integrations. You normally don't need to open these files yourself.
Keep the full scan directory together when sharing or archiving results so the
links from report.md continue to work.
Choose your next workflow
- Use the Security workbench to manage saved scans, findings, repositories, and scan activity in the desktop app.
- Run a scan from the CLI if you have beta access and need a repeatable terminal workflow with structured results.
- Run a standard or scoped scan to review a repository or one folder with the default workflow.
- Run a deep scan for a more thorough scan when you can allow for a longer runtime.
- Review code changes to assess a pull request, commit, branch range, or working-tree patch.
- Triage a backlog to review existing security findings.
- Fix and verify a finding after you accept one finding for remediation.
- Export or track findings to create JSON, CSV, SARIF, an approval-gated Linear, GitHub, or Jira issue, or a private draft GitHub Security Advisory.
- Write vulnerability reports to turn supplied findings, disclosure notes, source, and PoCs into self-contained reports.
- Propose security hardening to consider structural or architectural options based on scan results or other security evidence.