SpyBara
Go Premium

security.md 2026-10-15 23:00 UTC to 2026-10-16 23:02 UTC

This page contains 39 additions and 116 deletions.

2026
Fri 2 23:58 Wed 7 23:57 Fri 16 23:02

Codex Security

For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to the page URL.

Codex Security reviews code for vulnerabilities and reports evidence you can use to investigate and fix them. Choose how to run it based on where your code lives and how you want to review the results.

Choose where to start

Use When you want to Start here
Codex Security Cloud Scan connected GitHub repositories in Codex cloud or monitor new commits. Cloud setup
Codex Security plugin Scan a local repository in Codex and work through findings interactively. Run your first local scan
Codex Security CLI Run repeatable terminal scans or add checks to CI. CLI quickstart
Codex Security SDK Run scans and handle results in an application or developer tool. SDK guide

For your first local scan, use the plugin. In the ChatGPT desktop app, select Codex, install Codex Security, and open Security in the sidebar. The Security workbench keeps saved scans and findings available for review. You can also use the plugin in Codex CLI.

The Codex Security CLI and SDK are distributed in the public @openai/codex-security package. Scans using OpenAI inference require Codex Security access. See each quickstart for its runtime and authentication requirements.

Codex Security Cloud is a separate plugin, available in research preview on the web and in the desktop app. It requires workspace access, a GitHub connection, and a compatible Codex cloud environment. You can connect the repository and create an environment during setup.

Track open findings and fixes across repositories. This example uses fictional repositories, findings, and counts.

For security reviews posted to GitHub pull requests, see Security Review.

Choose the next task

After a local scan, review its scope and findings before deciding what to do next.

Task Guide
Focus a scan on a service or add security context Run a security scan
Run repeated reviews of the same repository or folder Run a deep scan
Check a pull request, commit, or local diff Review code changes
Assess findings from another scanner or issue tracker Triage a backlog
Generate a patch and check whether it fixes the issue Fix and verify findings
Share results or assign remediation work Export and track findings

For automation, use the CLI guides to scan repositories in bulk or run scans in CI. Look up commands and defaults in the CLI reference.

Codex Security scans application code. For permissions and sandbox controls that govern Codex itself, see Agent approvals and security.