Documentation 2026-08-26 23:58 UTC to 2026-08-27 21:01 UTC

7guidance you need to review the result. Scan only code you own or have7guidance you need to review the result. Scan only code you own or have

8permission to assess.8permission to assess.

9 9 

10Follow this quickstart to install the plugin and run a read-only scan of a local10Follow this quickstart to install the plugin and run a standard, read-only scan

11repository in Codex.11of a local repository in Codex.

12 12 

13This page covers the Codex Security plugin in the desktop app or Codex CLI. To13This page covers the Codex Security plugin in the desktop app or Codex CLI. To

14 scan a connected GitHub repository in Codex cloud, see [Codex Security cloud14 scan a connected GitHub repository in Codex cloud, see [Codex Security cloud

141 141 

142<WorkflowSteps variant="headings">142<WorkflowSteps variant="headings">

143 143 

1441. Ask for an ordinary scan1441. Ask for a standard scan

145 145 

146 Send this prompt in the new chat:146 Send this prompt in the new chat:

147 147 

193- `hardening/`, when structural hardening guidance and supporting proposals or193- `hardening/`, when structural hardening guidance and supporting proposals or

194 diagrams are available.194 diagrams are available.

195- Structured scan data in `scan-manifest.json`, `findings.json`, and195- Structured scan data in `scan-manifest.json`, `findings.json`, and

196 `coverage.json` for automation and integrations. You normally don't need to196 `coverage.json` for automation and integrations. You can review scan results

197 open these files yourself.197 without opening these files.

198 198 

199Keep the full scan directory together when sharing or archiving results so the199Keep the full scan directory together when sharing or archiving results so the

200links from `report.md` continue to work.200links from `report.md` continue to work.

166 166 

167## 0.1.15 (July 30, 2026)167## 0.1.15 (July 30, 2026)

168 168 

169### Keep scans accurate as projects change169### Preserve scan results when the repository changes

170 170 

171- Persist scan lifecycle and model metadata so scan history and progress remain171- Keep completed findings and reports tied to the original revision or

172 consistent across reloads.172 working-tree snapshot, even if files or the repository revision change while a

173- Preserve completed scans when project files change and avoid reusing SQLite173 scan runs.

174 scan directories.174- Show a completion warning when the selected code changes or the target becomes

175 175 unavailable instead of discarding the scan results.

176### Give feedback and recover findings176- Archive an existing scan before reusing its output directory for another scan.

177 177 

178- Submit false-positive feedback for findings from completed scans.178### Apply reviewed finding feedback

179- Recover malformed finding records during finalization instead of failing the179 

180 completed scan.180- Record a reason when you close a finding as a false positive.

181 181- Carry reviewed false-positive decisions into later scans of the same target

182### Handle more repository layouts and paths182 without applying them to another checkout or unrelated target.

183 183- Suppress a recurring finding only when the earlier reason still applies to

184- Preserve literal candidate paths and expand `~` in `CODEX_HOME` during184 the current code and security controls.

185 preflight.185 

186- Handle Git-related target validation errors without crashing and support nested186### Recover valid findings without overstating coverage

187 Git repositories in scan snapshots.187 

188- Keep Windows and sandbox path handling consistent during scan recovery.188- Keep valid findings when another finding, report, or hardening artifact is

189 189 malformed, and show a warning for the skipped data.

190### Reduce unnecessary scan work190- Remove duplicate findings and keep the strongest finding by severity,

191 191 confidence, and supporting evidence.

192- Keep standard-scan discovery adaptive to the repository and candidate list.192- Mark coverage as partial when Codex can't verify findings, review receipts, or

193- Stop retrying policy failures and remove the legacy fan-out prompt.193 follow-up areas.

194- Include incomplete coverage and deferred-review warnings in SARIF exports.

195 

196### Keep scan settings and progress visible

197 

198- Save the selected model and reasoning effort with standard and deep scans so

199 scan history and progress stay consistent across reloads.

200- Show the number of active and completed independent deep-scan reviews and

201 when result consolidation starts.

202- Adapt standard-scan discovery to the available worker capacity while keeping

203 one in-scope file list and one candidate review pass.

204 

205### Support more repository and filesystem layouts

206 

207- Include nested Git repositories when capturing a working-tree snapshot.

208- Preserve literal in-scope file paths and handle case-insensitive Windows

209 paths.

210- Expand a configured `CODEX_HOME` that starts with `~` during scan preflight.

194 211 

195## 0.1.14 (July 28, 2026)212## 0.1.14 (July 28, 2026)

196 213 

110[Safety Bug Bounty program](https://openai.com/index/safety-bug-bounty/). Follow110[Safety Bug Bounty program](https://openai.com/index/safety-bug-bounty/). Follow

111each program's scope and submission instructions.111each program's scope and submission instructions.

112 112 

113## Limitations

114 

115ChatGPT's built-in browser currently supports a subset of the WebMCP APIs.

116The following features aren't supported:

117 

118- **Declarative API:** Tools defined through HTML form attributes aren't

119 available as site tools.

120- **Tools in iframes:** The browser doesn't discover tools registered inside

121 iframes, including same-origin and cross-origin iframes.

122 

123Use JavaScript to register tools in the top-level page, as shown in the

124[next section](#add-webmcp-to-your-website). ChatGPT Work and Codex may still

125interact with forms using regular browser capabilities, but those interactions

126aren't WebMCP tool calls.

127 

128The WebMCP specification and Chrome's developer guide describe the broader

129APIs, including features that aren't currently supported in the built-in browser.

130 

113## Add WebMCP to your website131## Add WebMCP to your website

114 132 

115You can ask Codex to add WebMCP support to the web app or133You can ask Codex to add WebMCP support to the web app or