Use the Codex Security Cloud plugin to scan connected GitHub repositories, review findings, and monitor new commits.
Codex Security Cloud runs scans in Codex cloud. For scans of a local repository in the desktop app or CLI, use the separate Codex Security plugin.
1. Install and open the plugin
- Open Plugins in ChatGPT on the web or in the desktop app.
- Search the plugin marketplace for Codex Security Cloud.
- Install and enable the plugin, then open Security Cloud from your installed plugins or sidebar.
If access is unavailable, check with your workspace administrator.
2. Connect GitHub
Confirm that Codex cloud is set up for your workspace. In the plugin, select Scan. If prompted, select Connect GitHub and sign in with your own GitHub account. Each person who starts scans needs their own connection and access to the repository.
Codex Security Cloud doesn’t support workspace connections.
If a repository is missing, use Configure access in the repository picker to check the GitHub app’s organization and repository access. If you can’t grant access yourself, ask your GitHub administrator to add the repository.
3. Start a repository scan
- In New Scan, choose the repository.
- Review the environment. Auto creates an environment when you start. Use Customize to choose an existing environment. See Codex cloud environments for setup details.
- Under Scan Method, select One-Time Scan.
- Select Create.
Open the scan in Scans to follow its progress and review its findings and artifacts.
4. Review findings and available fixes
Open Findings. Use Open findings to review findings with a New, Triaged, or In Progress status. Search the list or use Filters to narrow the results. The Severity and status chart summarizes the matching findings.
Filter and review open findings. Repositories, findings, and counts are fictional and match the overview example.
Select an issue to review its affected code, validation evidence, and remediation guidance.
When a finding offers Fix with Codex, select it to generate a proposed patch. Review the patch before selecting Create draft pull request.
5. Monitor new commits
To review changes as new commits arrive:
- Select Scan, then choose the repository and review the environment.
- Under Scan Method, select Continuous Scanning. Codex Security scans the repository’s default branch.
- Choose Scan commit history from. Longer windows provide more context, but the initial scan takes longer.
- Optionally add threat model scoping guidance.
- Select Create.
Configure continuous scanning. The repository shown is fictional.
To adjust monitoring, open Repositories, select the repository, and open Monitoring settings. You can change the Cloud environment, choose how many days of history to review, and pause or enable monitoring. Select Save to apply changes.
The scan owner, people granted edit access, and Codex Security administrators can change monitoring settings. Changes, including pausing monitoring, apply to that repository’s shared configuration in the workspace, not just to the person making the change. If you can’t edit it, ask the scan owner or a Codex Security administrator.
Review and edit the generated threat model under Project context, then select Save. See Improving the threat model for guidance.
Related docs
- Codex Security gives the product overview.
- Codex Security Cloud FAQ covers common Cloud questions.
- Improving the threat model explains how to improve scan context and finding prioritization.