security/plugin/changelog.md +63 −4
5Use this changelog to see what changed in Codex Security and which plugin5Use this changelog to see what changed in Codex Security and which plugin
6versions are available from each installation source.6versions are available from each installation source.
7 7
88**Latest release in the hosted Codex Security catalog:** `0.1.15`.**Latest release in the hosted Codex Security catalog:** `0.1.17`.
9
10**Latest release in the public Codex CLI plugin marketplace:** `0.1.11`.
11 9
12Check the plugin version in your current Codex environment before you use a10Check the plugin version in your current Codex environment before you use a
13feature from a newer release. Reopening or rerunning a saved scan doesn't pin11feature from a newer release. Reopening or rerunning a saved scan doesn't pin
16These versions apply to the Codex Security plugin. The Codex app, Codex CLI,14These versions apply to the Codex Security plugin. The Codex app, Codex CLI,
17TypeScript SDK, and plugin app have separate version numbers.15TypeScript SDK, and plugin app have separate version numbers.
18 16
17## 0.1.17 (August 5, 2026)
18
19### Follow scan progress as it happens
20
21- Track the current scan phase, elapsed time, active workers, reviewed files, and
22 token usage from a single live progress view.
23- See repository review progress update as files finish instead of waiting for a
24 scan to complete.
25
26### Resume interrupted deep scans
27
28- Continue an in-progress deep scan after its coordinator restarts without
29 repeating completed file reviews.
30- Preserve completed discovery results, scan ownership, and pending work across
31 app updates or interrupted scan sessions.
32
33### Start and complete scans with less overhead
34
35- Start standard, change, and deep scans directly in native workflows without
36 opening the retired embedded scan widget.
37- Reuse completed scan summaries without reloading every finding unless you
38 request the complete structured results.
39
40## 0.1.16 (August 4, 2026)
41
42### Track measured scan usage
43
44- Review total, input, cached input, and output token usage across the main scan
45 and its delegated workers.
46- Distinguish complete, partial, and unavailable measurements instead of showing
47 missing usage as zero.
48
49### Run deeper scans with consistent results
50
51- Use the same threat-modeling, discovery, validation, attack-path analysis, and
52 reporting phases for standard and deep scans.
53- Configure deep scan workers, per-worker delegation, saturation, and discovery
54 limits from the CLI or SDK.
55- Run deep scans with the model's supported worker runtime and recover older
56 scan state without losing existing scan history.
57- Generate the primary report for change and deep scans without requiring
58 separate vulnerability write-ups or hardening recommendations.
59
60### Keep scan guidance and repository targets accurate
61
62- Update security guidance during an active scan and carry it into later phases
63 and delegated deep scan workers.
64- Preserve repository URLs, pull request references, and longer security context
65 without allowing network access you didn't request.
66- Fail scans when the repository or scan target changes during execution so
67 automation doesn't accept stale findings.
68- Honor enterprise proxy and trusted certificate settings in managed network
69 environments.
70
71### Write clearer vulnerability reports
72
73- Produce source-backed vulnerability reports that separate observed behavior
74 from unverified hypotheses.
75- Include realistic proof-of-concept limitations, affected versions, security
76 boundaries, and actionable remediation guidance.
77
19## 0.1.15 (July 30, 2026)78## 0.1.15 (July 30, 2026)
20 79
21### Keep scans accurate as projects change80### Keep scans accurate as projects change
42### Reduce unnecessary scan work101### Reduce unnecessary scan work
43 102
44- Keep standard-scan discovery adaptive to the repository and candidate list.103- Keep standard-scan discovery adaptive to the repository and candidate list.
45104- Stop retrying policy failures and remove the legacy fanout prompt.- Stop retrying policy failures and remove the legacy fan-out prompt.
46 105
47## 0.1.14 (July 28, 2026)106## 0.1.14 (July 28, 2026)
48 107