security/threat-model.md Codex Docs, 2026-02-20 12:16 UTC → 2026-03-08 00:35 UTC

1# Improving the threat model

2 

3Learn what a threat model is and how editing it improves Codex Security's suggestions.

4 

5## What a threat model is

6 

7A threat model is a short security summary of how your repository works. In Codex Security, you edit it as a `project overview`, and the system uses it as scan context for future scans, prioritization, and review.

8 

9Codex Security creates the first draft from the code. If the findings feel off, this is the first thing to edit.

10 

11A useful threat model calls out:

12 

13- entry points and untrusted inputs

14- trust boundaries and auth assumptions

15- sensitive data paths or privileged actions

16- the areas your team wants reviewed first

17 

18For example:

19 

20> Public API for account changes. Accepts JSON requests and file uploads. Uses an internal auth service for identity checks and writes billing changes through an internal service. Focus review on auth checks, upload parsing, and service-to-service trust boundaries.

21 

22That gives Codex Security a better starting point for future scans and finding prioritization.

23 

24## Improving and revisiting the threat model

25 

26If you want to improve the results, edit the threat model first. Use it when findings are missing the areas you care about or showing up in places you don't expect. The threat model changes future scan context.

27 

28Some users copy the current threat model into Codex, have a conversation to

29 improve it based on the areas they want reviewed more closely, and then paste

30 the updated version back into the web UI.

31 

32### Where to edit

33 

34To review or update the threat model, go to [Codex Security scans](https://chatgpt.com/codex/security/scans), open the repository, and click **Edit**.

35 

36## Related docs

37 

38- [Codex Security setup](https://developers.openai.com/codex/security/setup) covers repository setup and findings review.

39- [Codex Security](https://developers.openai.com/codex/security) gives the product overview.

40- [FAQ](https://developers.openai.com/codex/security/faq) covers common questions.