1# Codex Security cloud setup1# Codex Security Cloud setup
2 2
3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.
4 4
5This page walks you from initial access to reviewed findings and remediation5Use the Codex Security Cloud plugin to scan connected GitHub repositories,
6pull requests in Codex Security cloud.6review findings, and monitor new commits.
7 7
8Confirm you've set up Codex cloud first. If not, see [Codex8Codex Security Cloud runs scans in [Codex cloud](https://learn.chatgpt.com/docs/cloud). For scans of a
9 cloud](https://learn.chatgpt.com/docs/cloud) to get started.9 local repository in the desktop app or CLI, use the separate [Codex Security
10 plugin](https://learn.chatgpt.com/docs/security/plugin).
10 11
11## 1. Access and environment12## 1. Install and open the plugin
12 13
13Codex Security cloud scans GitHub repositories connected through141. Open **Plugins** in ChatGPT on the web or in the desktop app.
14[Codex cloud](https://learn.chatgpt.com/docs/cloud).152. Search the plugin marketplace for **Codex Security Cloud**.
15 163. Install and enable the plugin, then open **Security Cloud** from your
16- Confirm your workspace has access to Codex Security cloud.17 installed plugins or sidebar.
17- Confirm the repository you want to scan is available in Codex cloud.
18
19Go to [Codex environments](https://chatgpt.com/codex/settings/environments) and check whether the repository already has an environment. If it doesn't, create one there before continuing.
20
21<CtaPillLink
22 href="https://chatgpt.com/codex/settings/environments"
23 label="Open environments"
24 icon="external"
25 class="my-8"
26/>
27
28
29
30
31
32
33> Illustration: Codex environments
34
35
36
37
38
39
40## 2. New security scan
41
42After the environment exists, go to [Create a security scan](https://chatgpt.com/codex/security/scans/new) and choose the repository you just connected.
43 18
44<CtaPillLink19<CtaPillLink
45 href="https://chatgpt.com/codex/security/scans/new"20 href="https://chatgpt.com/plugins"
46 label="Create a security scan"21 label="Open plugin marketplace"
47 icon="external"22 icon="external"
48 class="my-8"23 class="my-8"
49/>24/>
50 25
51Codex Security scans repositories from newest commits backward first. It uses this to build and refresh scan context as new commits come in.26If access is unavailable, check with your workspace administrator.
52
53To configure a repository:
54
551. Select the GitHub organization.
562. Select the repository.
573. Select the branch you want to scan.
584. Select the environment.
595. Choose a **history window**. Longer windows provide more context, but backfill takes longer.
606. Click **Create**.
61
62
63
64
65 27
28## 2. Connect GitHub
66 29
67> Illustration: Create a security scan30Confirm that [Codex cloud](https://learn.chatgpt.com/docs/cloud) is set up for your workspace. In the
31plugin, select **New scan**. If prompted, select **Connect GitHub** and grant
32access to the repositories you want to scan.
68 33
34If a repository is missing, check its GitHub connection and permissions.
69 35
36## 3. Start a repository scan
70 37
381. In **New scan**, choose the repository.
392. Select a compatible **Cloud environment**. If none exists, select
40 **Create environment** to configure one. See [Codex cloud
41 environments](https://learn.chatgpt.com/docs/environments/cloud-environment) for setup details.
423. Under **What to scan**, select **Repository**, the default.
434. Select **Start scan**.
71 44
45Open the scan in **Scans** to follow its progress and review its findings and
46artifacts.
72 47
48## 4. Review findings and available fixes
73 49
74## 3. Initial scans can take a while50Open **Findings** and select an issue to review its affected code, validation
75 51evidence, and remediation guidance.
76When you create the scan, Codex Security first runs a commit-level security pass across the selected history window.
77The initial backfill can take a few hours, especially for larger repositories or longer windows.
78If findings aren't visible right away, this is expected. Wait for the initial scan to finish before opening a ticket or troubleshooting.
79
80Initial scan setup is automatic and thorough. This can take a few hours. Don’t
81 be alarmed if the first set of findings is delayed.
82
83## 4. Review scans and improve the threat model
84
85<CtaPillLink
86 href="https://chatgpt.com/codex/security/scans"
87 label="Review scans"
88 icon="external"
89 class="my-8"
90/>
91 52
53When a finding offers **Fix with Codex**, select it to generate a proposed
54patch. Review the patch before selecting **Create draft pull request**.
92 55
56## 5. Monitor new commits
93 57
58To review changes as new commits arrive:
94 59
601. Select **New scan**, then choose the repository and Cloud environment.
612. Under **What to scan**, select **Commit changes**.
623. Select **Create**.
95 63
64To adjust monitoring, open **Repositories**, select the repository, and open
65**Monitoring settings**. You can change the Cloud environment, choose how
66many days of history to review, and pause or enable monitoring.
67Select **Save** to apply changes.
96 68
97> Illustration: Threat model editor in Codex Security69Review and edit the generated threat model under **Project context**, then
98 70select **Save**. See [Improving the threat model](https://learn.chatgpt.com/docs/security/threat-model)
99 71for guidance.
100
101
102
103
104When the initial scan finishes, open the scan and review the threat model that was generated.
105After initial findings appear, update the threat model so it matches your architecture, trust boundaries, and business context.
106This helps Codex Security rank issues for your team.
107
108If you want scan results to change, you can edit the threat model with your
109 updated scope, priorities, and assumptions.
110
111After initial findings appear, revisit the model so scan guidance stays aligned with current priorities.
112Keeping it current helps Codex Security produce better suggestions.
113
114For a deeper explanation of threat models and how they affect criticality and triage, see [Improving the threat model](https://learn.chatgpt.com/docs/security/threat-model).
115
116## 5. Review findings and patch
117
118After the initial backfill completes, review findings from the **Findings** view.
119
120<CtaPillLink
121 href="https://chatgpt.com/codex/security/findings"
122 label="Open findings"
123 icon="external"
124 class="my-8"
125/>
126
127You can use two views:
128
129- **Recommended Findings**: an evolving top 10 list of the most critical issues in the repo
130- **All Findings**: a sortable, filterable table of findings across the repository
131
132
133
134
135> Illustration: Recommended findings view
136
137
138
139
140Click a finding to open its detail page, which includes:
141
142- a concise description of the issue
143- key metadata such as commit details and file paths
144- contextual reasoning about impact
145- relevant code excerpts
146- call-path or data-flow context when available
147- validation steps and validation output
148
149You can review each finding and create a PR directly from the finding detail page.
150
151<CtaPillLink
152 href="https://chatgpt.com/codex/security/findings"
153 label="Review findings and create a PR"
154 icon="external"
155 class="my-8"
156/>
157 72
158## Related docs73## Related docs
159 74
160- [Codex Security](https://learn.chatgpt.com/docs/security) gives the product overview.75- [Codex Security](https://learn.chatgpt.com/docs/security) gives the product overview.
161- [Codex Security cloud FAQ](https://learn.chatgpt.com/docs/security/faq) covers common cloud questions.76- [Codex Security Cloud FAQ](https://learn.chatgpt.com/docs/security/faq) covers common Cloud questions.
162- [Improving the threat model](https://learn.chatgpt.com/docs/security/threat-model) explains how to improve scan context and finding prioritization.77- [Improving the threat model](https://learn.chatgpt.com/docs/security/threat-model) explains how to improve scan context and finding prioritization.
