24| `codex-security scan` | Run a Codex Security scan. |24| `codex-security scan` | Run a Codex Security scan. |
25| `codex-security install-hook` | Install a Git pre-commit security scan. |25| `codex-security install-hook` | Install a Git pre-commit security scan. |
26| `codex-security bulk-scan` | Discover repositories and run resumable bulk scans. |26| `codex-security bulk-scan` | Discover repositories and run resumable bulk scans. |
27| `codex-security scans` | List, inspect, match, rerun, and compare saved scans. |27| `codex-security scans` | List, inspect, compare, and retrieve saved scan logs. |
28| `codex-security findings` | Review and update saved security findings. |28| `codex-security findings` | Review and update saved security findings. |
29| `codex-security export` | Export completed findings as CSV, JSON, or SARIF. |29| `codex-security export` | Export completed findings as CSV, JSON, or SARIF. |
30| `codex-security validate` | Check one or more candidate security findings. |30| `codex-security validate` | Check one or more candidate security findings. |
299 299
300To add scan instructions, provide a text or Markdown file with300To add scan instructions, provide a text or Markdown file with
301`--scan-prompt-file`. Use `--post-scan-prompt-file` to run follow-up301`--scan-prompt-file`. Use `--post-scan-prompt-file` to run follow-up
302instructions in the same authenticated session after a completed scan with302instructions in the same authenticated session after successful scans and
303complete coverage:303scans with incomplete coverage or errors:
304 304
305```bash305```bash
306npx @openai/codex-security scan . \306npx @openai/codex-security scan . \
310 310
311For example, use the scan prompt to focus on authorization boundaries and ask311For example, use the scan prompt to focus on authorization boundaries and ask
312the follow-up to write a new `post-scan-summary.md` in the scan directory.312the follow-up to write a new `post-scan-summary.md` in the scan directory.
313The follow-up doesn't run after cancellation or when the scan reaches its cost
314limit.
313 315
314### Set output and policy options316### Set output and policy options
315 317
475repository. Use `--scan-prompt-file FILE` to add shared scan instructions; the477repository. Use `--scan-prompt-file FILE` to add shared scan instructions; the
476CSV `prompt` column adds repository-specific instructions after that shared478CSV `prompt` column adds repository-specific instructions after that shared
477prompt. `--post-scan-prompt-file FILE` runs follow-up instructions after each479prompt. `--post-scan-prompt-file FILE` runs follow-up instructions after each
478completed scan with complete coverage.480scan, including scans with incomplete coverage or errors. It doesn't run after
481cancellation or when a scan reaches its cost limit.
479 482
480`--workers` limits simultaneous repository scans and defaults to `4`. `--mode`483`--workers` limits simultaneous repository scans and defaults to `4`. `--mode`
481defaults to `standard`, and `--max-attempts` defaults to `1`. Set484defaults to `standard`, and `--max-attempts` defaults to `1`. Set
519npx @openai/codex-security scans show SCAN_ID522npx @openai/codex-security scans show SCAN_ID
520```523```
521 524
525Add `--show-linked-findings` to include finding links from earlier scans.
526
522Rerun the scan against the current checkout using its original configuration:527Rerun the scan against the current checkout using its original configuration:
523 528
524```bash529```bash
525npx @openai/codex-security scans rerun SCAN_ID530npx @openai/codex-security scans rerun SCAN_ID
526```531```
527 532
533### Inspect saved scan logs
534
535Read the complete saved session events for a scan and its workers:
536
537```bash
538npx @openai/codex-security scans logs SCAN_ID
539```
540
541Add `--json` for a machine-formatted result containing full information.
542
528### Match and compare findings543### Match and compare findings
529 544
530Compare two scans to find new, persisting, reopened, resolved, and unknown545Compare two scans to find new, persisting, reopened, resolved, and unknown
559 574
560## `codex-security findings`575## `codex-security findings`
561 576
562Record a reviewed finding as a false positive:577List open findings across the current repository's scans:
578
579```bash
580npx @openai/codex-security findings list
581```
582
583Pass a repository path to inspect another checkout:
584
585```bash
586npx @openai/codex-security findings list /path/to/repository
587```
588
589Add `--json` for structured output. The list identifies findings seen in the
590latest scan and earlier findings that weren't confirmed in that scan.
591
592Note that earlier findings remain open until resolved or dismissed (absence
593from the latest scan is not interpreted as proof that it's fixed).
594
595To record a reviewed finding as a false positive:
563 596
564```text597```text
565usage: codex-security findings false-positive OCCURRENCE_ID598usage: codex-security findings false-positive OCCURRENCE_ID
752flag. `LOG_LEVEL=debug` also enables diagnostics when785flag. `LOG_LEVEL=debug` also enables diagnostics when
753`CODEX_SECURITY_LOG_LEVEL` is unset.786`CODEX_SECURITY_LOG_LEVEL` is unset.
754 787
755These logging controls apply only to the CLI. Credentials and provider
756identifiers remain redacted, and structured scan results remain on stdout.
757
758### Completion summary788### Completion summary
759 789
760A completed scan writes its finding count, severity breakdown, coverage,790A completed scan writes its open repository finding count, severity breakdown,
761elapsed time, report path, and result directory to stderr. It includes token791coverage, elapsed time, report path, and result directory to stderr. It
762usage and estimated cost when available:792includes token usage and estimated cost when available:
763 793
764```text794```text
765codex-security: Findings: 4 (1 critical, 2 high, 1 informational). Coverage: complete.795 REPORT /path/to/scan/report.md
766codex-security: Elapsed: 1s.796
767codex-security: Tokens: 1,250 input, 200 cached, 30 output.797 FINDINGS 4 (3 confirmed this scan; 1 previously found; 1 critical, 2 high, 1 informational)
768codex-security: Report: /path/to/scan/report.md798 COVERAGE complete
769codex-security: Results: /path/to/scan799 ELAPSED 1s
800 TOKENS 1,250 input, 200 cached, 30 output
801 RESULTS /path/to/scan
770```802```
771 803
772Informational findings count toward the summary total. Severity policies804Informational findings count toward the summary total. Severity policies
773evaluate only `critical`, `high`, `medium`, and `low` findings.805evaluate only `critical`, `high`, `medium`, and `low` findings from the current
806scan, not earlier findings shown in the repository total.
774 807
775### JSON output808### JSON output
776 809
779 812
780```text813```text
781manifest814manifest
815repositoryFindings
782findings816findings
783coverage817coverage
784scanDir818scanDir
786reportPath820reportPath
787artifactsDir821artifactsDir
788sarifPath822sarifPath
823cost
789turn824turn
790 id825 id
791 status826 status
