2 2 

3> For the complete documentation index, see [llms.txt](/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.3> For the complete documentation index, see [llms.txt](/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 4 

5Assess code, review changes, and remediate security findings.5Find and fix vulnerabilities in your code.

6 6 

7Codex can help engineering and security teams assess authorized code, gather7Use Codex to investigate security findings, assess their impact, and develop and

8evidence, and turn reviewed findings into focused fixes. These use cases cover8test fixes. Start with your source code or findings from tools you already use.

9repository scans, change reviews, dependency incidents, and vulnerability

10remediation.

11 9 

12## Assess a repository10## Code security

13 11 

14Use the Codex Security plugin to run a comprehensive scan across an authorized12Choose a guide to scan a repository, review code changes, assess dependency

15repository, review plausible findings, and produce reports that support human13exposure, or fix an existing finding.

16triage. Comprehensive scans take longer because they repeat discovery across

17independent workers.

18 14 

19- [Run a deep security scan](https://developers.openai.com/codex/use-cases/deep-security-scan): Use the Codex Security plugin to run a more comprehensive audit of a repository or scoped...15- [Run a deep security scan](https://developers.openai.com/codex/use-cases/deep-security-scan): Use the Codex Security plugin to run a more comprehensive audit of a repository or scoped...

20 

21## Review changes before merge

22 

23Ask Codex to inspect a pull request, branch, commit, or working-tree diff for

24security regressions and return evidence tied to the changed code.

25 

26- [Scan code changes for security](https://developers.openai.com/codex/use-cases/scan-code-changes-for-security): Use the Codex Security plugin to examine a Git-backed change set, validate plausible...16- [Scan code changes for security](https://developers.openai.com/codex/use-cases/scan-code-changes-for-security): Use the Codex Security plugin to examine a Git-backed change set, validate plausible...

27 

28## Audit dependency incidents

29 

30Turn a public package or supply chain advisory into a read-only repository

31audit covering manifests, lock files, scripts, workflows, and exposure paths.

32 

33- [Audit dependency incidents](https://developers.openai.com/codex/use-cases/dependency-incident-audits): Use Codex to turn a public package or supply chain advisory into a read-only audit, then...17- [Audit dependency incidents](https://developers.openai.com/codex/use-cases/dependency-incident-audits): Use Codex to turn a public package or supply chain advisory into a read-only audit, then...

34 

35## Remediate reviewed findings

36 

37Bring Codex an approved finding from a security report, advisory, or ticket,

38then have it make a minimal fix and verify that the vulnerable behavior no

39longer reproduces.

40 

41- [Remediate a vulnerability backlog](https://developers.openai.com/codex/use-cases/remediate-vulnerability-backlog): Bring in approved findings from ticketing tools or vulnerability reporting systems, then use...18- [Remediate a vulnerability backlog](https://developers.openai.com/codex/use-cases/remediate-vulnerability-backlog): Bring in approved findings from ticketing tools or vulnerability reporting systems, then use...