Codex Security

Codex Security is an application security agent that helps security and engineering teams find, confirm, and fix vulnerabilities. Use it in Codex, from your terminal, through the TypeScript SDK, or with connected GitHub repositories.

For your first local scan, start with the Codex Security plugin quickstart.

Use Codex Security in the desktop app

In the ChatGPT desktop app, open the ChatGPT dropdown and select Codex. Install and enable the Codex Security plugin to open Security in the sidebar. The Security workbench keeps your scans, findings, and repositories in one place while Codex runs each scan in a task.

• Use Scans to start scans, follow their progress, and review saved results.
• Use Findings to inspect issues and evidence across completed scans.
• Use Repositories to review repository history and open findings.

See Use the Security workbench for the complete desktop-app workflow.

Explore plugin use cases

• Run a security scan for a repository or one scoped folder.
• Run a deep security scan when you need broader review and can wait longer for it to finish.
• Review code changes before you merge a pull request or branch.
• Triage a backlog when you have existing security findings to review.
• Fix and verify findings with bounded patches for approved findings.
• Export or track findings as portable artifacts or approval-gated tracking destinations.
• Write vulnerability reports from supplied findings, disclosure notes, source, and PoCs.
• Propose security hardening from scan results or other security evidence.
• See what’s new in the Codex Security plugin.

Codex Security CLI and SDK

The CLI and TypeScript SDK are available as the public @openai/codex-security package. Run the CLI with npx:

npx @openai/codex-security --help

Running scans requires Codex Security access. For best results, use an account verified for Trusted Access for Cyber.

Use the same scanner as the plugin across repositories and over time. The CLI discovers GitHub repositories, resumes bulk scans, tracks findings across scans, and records false-positive feedback. Add your architecture and security policies, set an estimated cost limit, or run checks in CI and before commits. Use the TypeScript SDK to build scanning, progress reporting, and cost controls into an application or developer tool.

• Start with the CLI quickstart to set up the CLI, preflight a repository, and run a local scan.
• Run bulk security scans to discover GitHub repositories or run a resumable campaign from a CSV inventory.
• Run scans in CI to review pull-request changes, preserve artifacts, upload SARIF, and set a severity policy.
• Read the CLI FAQ for answers about scan history, false-positive feedback, coverage, and fix verification.
• Use the CLI reference to check supported commands, flags, output formats, artifacts, and exit codes.
• Integrate the TypeScript SDK to select targets, inspect results, track progress, and cancel scans from code.

Codex Security Cloud

Codex Security Cloud is a plugin for scanning connected GitHub repositories in Codex cloud. It’s available in research preview on the web and in the desktop app.

Open Plugins to find and install Codex Security Cloud. Follow Cloud setup to connect GitHub and start your first scan.

How Codex Security Cloud works

Choose One-Time Scan to review a repository once, or Continuous Scanning to monitor new commits. Codex uses repository context to identify likely vulnerabilities and validates issues in an isolated environment when possible.

Use Scans to follow progress, Findings to review issues, and Repositories to manage monitoring. Review proposed patches before creating a pull request.

Codex Security Cloud access and prerequisites

Use a workspace with Codex Security Cloud access, a connected GitHub repository, and a compatible Codex cloud environment. You can connect GitHub and create an environment during scan setup.

If access is unavailable, check with your workspace administrator.

Related docs

• Codex Security plugin quickstart walks through installation and a first local scan.
• Security workbench explains saved scans, findings, repositories, and scan activity in the desktop app.
• Codex Security CLI quickstart walks through setup, preflight, and a first terminal scan.
• Run bulk security scans explains GitHub discovery, CSV inventories, campaign results, and resume behavior.
• Codex Security CLI FAQ answers common questions about scans, findings, coverage, and costs.
• Codex Security TypeScript SDK explains how to run scans from an application or developer tool.
• Codex Security Cloud setup details setup, scanning, and findings review.
• Security Review explains how to run in-depth security reviews on GitHub pull requests.
• Improving the threat model explains how to tune scope, entry points, and criticality assumptions.
• Codex Security Cloud FAQ covers common cloud product questions.