2 2
3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.
4 4
5Learn what a threat model is and how editing it improves Codex Security's suggestions.5Review and update the threat model for a repository monitored by Codex Security Cloud.
6 6
7## What a threat model is7## What a threat model is
8 8
9A threat model is a short security summary of how your repository works. In Codex Security, you edit it as a `project overview`, and the system uses it as scan context for future scans, prioritization, and review.9A threat model is a short security summary of how your repository works. Codex Security creates the first draft from the code and uses it to guide future commit scans and prioritize findings.
10
11Codex Security creates the first draft from the code. If the findings feel off, this is the first thing to edit.
12 10
13A useful threat model calls out:11A useful threat model calls out:
14 12
21 19
22> Public API for account changes. Accepts JSON requests and file uploads. Uses an internal auth service for identity checks and writes billing changes through an internal service. Focus review on auth checks, upload parsing, and service-to-service trust boundaries.20> Public API for account changes. Accepts JSON requests and file uploads. Uses an internal auth service for identity checks and writes billing changes through an internal service. Focus review on auth checks, upload parsing, and service-to-service trust boundaries.
23 21
24That gives Codex Security a better starting point for future scans and finding prioritization.
25
26## Improving and revisiting the threat model22## Improving and revisiting the threat model
27 23
28If you want to improve the results, edit the threat model first. Use it when findings are missing the areas you care about or showing up in places you don't expect. The threat model changes future scan context.24Update the threat model when your architecture or priorities change, or when findings miss the areas you care about.
29
30Some users copy the current threat model into Codex, use a chat to improve it
31 based on the areas they want reviewed more closely, and then paste the updated
32 version back into the web UI.
33 25
34### Where to edit26### Where to edit
35 27
36To review or update the threat model, go to [Codex Security scans](https://chatgpt.com/codex/security/scans), open the repository, and click **Edit**.281. Open the Codex Security Cloud plugin. See [Cloud setup](https://learn.chatgpt.com/docs/security/setup)
29 if you haven't installed it or configured commit monitoring.
302. Open **Repositories** and select the monitored repository.
313. Open **Monitoring settings**.
324. Under **Project context**, edit **Threat model**, then select **Save**.
33
34Changes apply to future scans.
37 35
38## Related docs36## Related docs
39 37
40- [Codex Security cloud setup](https://learn.chatgpt.com/docs/security/setup) covers repository setup and findings review.38- [Codex Security Cloud setup](https://learn.chatgpt.com/docs/security/setup) covers repository setup and findings review.
41- [Codex Security](https://learn.chatgpt.com/docs/security) gives the product overview.39- [Codex Security](https://learn.chatgpt.com/docs/security) gives the product overview.
42- [Codex Security cloud FAQ](https://learn.chatgpt.com/docs/security/faq) covers common cloud questions.40- [Codex Security Cloud FAQ](https://learn.chatgpt.com/docs/security/faq) covers common cloud questions.
