security/setup.md Codex Docs, 2026-03-17 18:24 UTC → 2026-05-14 21:00 UTC

14 14 

15Go to [Codex environments](https://chatgpt.com/codex/settings/environments) and check whether the repository already has an environment. If it doesn't, create one there before continuing.15Go to [Codex environments](https://chatgpt.com/codex/settings/environments) and check whether the repository already has an environment. If it doesn't, create one there before continuing.

16 16 

17[Open environments](https://chatgpt.com/codex/settings/environments)17<CtaPillLink

18 18 href="https://chatgpt.com/codex/settings/environments"

19![Codex environments](/_astro/create_environment.M-EPszPH.png)19 label="Open environments"

20 icon="external"

21 class="my-8"

22/>

23 

24<div class="not-prose my-8 max-w-6xl overflow-hidden rounded-xl border border-subtle bg-surface">

25 <img

26 src={createEnvironment.src}

27 alt="Codex environments"

28 class="block h-auto w-full"

29 />

30</div>

20 31 

21## 2. New security scan32## 2. New security scan

22 33 

23After the environment exists, go to [Create a security scan](https://chatgpt.com/codex/security/scans/new) and choose the repository you just connected.34After the environment exists, go to [Create a security scan](https://chatgpt.com/codex/security/scans/new) and choose the repository you just connected.

24 35 

25[Create a security scan](https://chatgpt.com/codex/security/scans/new)36<CtaPillLink

37 href="https://chatgpt.com/codex/security/scans/new"

38 label="Create a security scan"

39 icon="external"

40 class="my-8"

41/>

26 42 

27Codex Security scans repositories from newest commits backward first. It uses this to build and refresh scan context as new commits come in.43Codex Security scans repositories from newest commits backward first. It uses this to build and refresh scan context as new commits come in.

28 44 

355. Choose a **history window**. Longer windows provide more context, but backfill takes longer.515. Choose a **history window**. Longer windows provide more context, but backfill takes longer.

366. Click **Create**.526. Click **Create**.

37 53 

38![Create a security scan](/_astro/create_scan.mEjmf4U_.png)54<div class="not-prose my-8 max-w-6xl overflow-hidden rounded-xl border border-subtle bg-surface">

55 <img

56 src={createScan.src}

57 alt="Create a security scan"

58 class="block h-auto w-full"

59 />

60</div>

39 61 

40## 3. Initial scans can take a while62## 3. Initial scans can take a while

41 63 

48 70 

49## 4. Review scans and improve the threat model71## 4. Review scans and improve the threat model

50 72 

51[Review scans](https://chatgpt.com/codex/security/scans)73<CtaPillLink

52 74 href="https://chatgpt.com/codex/security/scans"

53![Threat model editor in Codex Security](/_astro/review_threat_model.JTLMQEmx.png)75 label="Review scans"

76 icon="external"

77 class="my-8"

78/>

79 

80<div class="not-prose my-8 max-w-6xl overflow-hidden rounded-xl border border-subtle bg-surface">

81 <img

82 src={reviewThreatModel.src}

83 alt="Threat model editor in Codex Security"

84 class="block h-auto w-full"

85 />

86</div>

54 87 

55When the initial scan finishes, open the scan and review the threat model that was generated.88When the initial scan finishes, open the scan and review the threat model that was generated.

56After initial findings appear, update the threat model so it matches your architecture, trust boundaries, and business context.89After initial findings appear, update the threat model so it matches your architecture, trust boundaries, and business context.

68 101 

69After the initial backfill completes, review findings from the **Findings** view.102After the initial backfill completes, review findings from the **Findings** view.

70 103 

71[Open findings](https://chatgpt.com/codex/security/findings)104<CtaPillLink

105 href="https://chatgpt.com/codex/security/findings"

106 label="Open findings"

107 icon="external"

108 class="my-8"

109/>

72 110 

73You can use two views:111You can use two views:

74 112 

88 126 

89You can review each finding and create a PR directly from the finding detail page.127You can review each finding and create a PR directly from the finding detail page.

90 128 

91[Review findings and create a PR](https://chatgpt.com/codex/security/findings)129<CtaPillLink

130 href="https://chatgpt.com/codex/security/findings"

131 label="Review findings and create a PR"

132 icon="external"

133 class="my-8"

134/>

92 135 

93## Related docs136## Related docs

94 137