Security

For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to the page URL.

Find and fix vulnerabilities in your code.

Use Codex to investigate security risks in your code and dependencies, then develop and test fixes. Start with a repository, a code change, or findings from tools you already use.

Set up Daybreak Blue

If your security team plans to use Daybreak Blue, a ChatGPT Enterprise workspace owner can grant access to selected members.

• Getting Started with Daybreak Blue.: Daybreak Blue reduces refusals on supported models for authorized defensive work

Find vulnerabilities

Start with a scan of one repository, run a deeper review, or scan a repository inventory. Automate scans in CI to review code on a schedule or as it changes. Review the findings and coverage to decide where to investigate next.

• Run your first security scan: Use the Codex Security plugin to scan a local repository, review the evidence and coverage...
• Run a deep security scan: Use the Codex Security plugin to run a more comprehensive audit of a repository or scoped...
• Scan multiple repositories: Use the Codex Security CLI to scan a list of repositories at specific commits, review each...
• Automate security scans in CI: Add the Codex Security CLI to your CI pipeline

Review changes and dependencies

Check a pull request or local diff for security regressions, or assess your repository's exposure to a package or supply chain advisory. Gather evidence before deciding what needs action.

• Scan code changes for security: Use the Codex Security plugin to examine a Git-backed change set, validate plausible...
• Audit dependency incidents: Use Codex to turn a public package or supply chain advisory into a read-only audit, then...

Fix and verify findings

Turn a reviewed scan finding into a focused patch, or work through findings from an existing backlog. Review each change and its verification evidence before preparing it for merge.

• Fix a finding from your security scan: Use the Codex Security plugin to turn a reviewed scan finding into a focused patch
• Remediate a vulnerability backlog: Bring in approved findings from ticketing tools or vulnerability reporting systems, then use...

Secure the SDLC

Automate security reviews by defining your application’s security requirements, giving Codex the context to assess changes, and configuring reviews for pull requests and dependency updates.

• Set up security context: Learn how to prepare and configure the context Codex needs for security reviews and scans.
• Automate security reviews in GitHub Cloud: Connect a repository and configure review triggers with Codex Security Review.
• Review code changes in Codex Desktop: Start a security review from Codex or your repository’s Codex project.
• Run security reviews from the CLI: Use Codex Security CLI to review uncommitted work or changes on a branch.
• Create custom review workflows with GitHub Actions: Make security reviews a repeatable part of your development process
• Manage supply chain risk in the CI/CD: Assess how third-party dependencies affect your application’s security with Codex Security CLI