Codex Security reviews code for vulnerabilities and reports evidence you can use to investigate and fix them. Choose how to run it based on where your code lives and how you want to review the results.
Choose where to start
| Use | When you want to | Start here |
|---|---|---|
| Codex Security Cloud | Scan connected GitHub repositories in Codex cloud or monitor new commits. | Cloud setup |
| Codex Security plugin | Scan a local repository in Codex and work through findings interactively. | Run your first local scan |
| Codex Security CLI | Run repeatable terminal scans or add checks to CI. | CLI quickstart |
| Codex Security SDK | Run scans and handle results in an application or developer tool. | SDK guide |
For your first local scan, use the plugin. In the ChatGPT desktop app, select Codex, install Codex Security, and open Security in the sidebar. The Security workbench keeps saved scans and findings available for review. You can also use the plugin in Codex CLI.
The Codex Security CLI and SDK are distributed in the public @openai/codex-security package. Scans using OpenAI inference require Codex Security access. See each quickstart for its runtime and authentication requirements.
Codex Security Cloud is a separate plugin, available in research preview on the web and in the desktop app. It requires workspace access, a GitHub connection, and a compatible Codex cloud environment. You can connect the repository and create an environment during setup.
Track open findings and fixes across repositories. This example uses fictional repositories, findings, and counts.
For security reviews posted to GitHub pull requests, see Security Review.
Choose the next task
After a local scan, review its scope and findings before deciding what to do next.
| Task | Guide |
|---|---|
| Focus a scan on a service or add security context | Run a security scan |
| Run repeated reviews of the same repository or folder | Run a deep scan |
| Check a pull request, commit, or local diff | Review code changes |
| Assess findings from another scanner or issue tracker | Triage a backlog |
| Generate a patch and check whether it fixes the issue | Fix and verify findings |
| Share results or assign remediation work | Export and track findings |
For automation, use the CLI guides to scan repositories in bulk or run scans in CI. Look up commands and defaults in the CLI reference.
Codex Security scans application code. For permissions and sandbox controls that govern Codex itself, see Agent approvals and security.