Codex Security plugin quickstart

Codex Security scans your code for vulnerabilities and validates plausible findings. For each reportable issue, it gives you the evidence and remediation guidance you need to review the result. Scan only code you own or have permission to assess.

Follow this quickstart to install the plugin and run a read-only scan of a local repository in Codex.

Install the plugin

Run your first scan

For the best scan quality, use gpt-5.6-sol with xhigh reasoning effort.

1. Open the scan setup

   Select Security in the sidebar, open Scans, and select + Scan.

2. Choose the codebase and scan area

   Select an existing repository or use another folder. Choose Codebase, leave Deep scan off, and select the entire repository or one folder. Confirm that the branch and revision identify the code you intended to scan.

3. Add relevant context

   Choose the model and reasoning effort. Open Additional context only when you need to describe a specific attack vector, security-sensitive area, or repository detail that should guide the review.

   

   

4. Start the scan

   Select Start scan and follow the scan phases in the Security workbench. Select View activity to inspect the Codex task that performs the scan.

5. Review the result

   Open the completed scan to inspect findings, coverage, and available report artifacts. Use Findings to review issues across scans or Repositories to inspect a repository’s scan history.

   

   

What the scan creates

• report.md, the primary readable entry point to the scan results.
• findings/<slug>/, when detailed vulnerability reports and supporting proof-of-concept files are available.
• hardening/, when structural hardening guidance and supporting proposals or diagrams are available.
• Structured scan data in scan-manifest.json, findings.json, and coverage.json for automation and integrations. You normally don’t need to open these files yourself.

Keep the full scan directory together when sharing or archiving results so the links from report.md continue to work.

Choose your next workflow

• Use the Security workbench to manage saved scans, findings, repositories, and scan activity in the desktop app.
• Run a scan from the CLI if you have beta access and need a repeatable terminal workflow with structured results.
• Run a standard or scoped scan to review a repository or one folder with the default workflow.
• Run a deep scan for a more thorough scan when you can allow for a longer runtime.
• Review code changes to assess a pull request, commit, branch range, or working-tree patch.
• Triage a backlog to review existing security findings.
• Fix and verify a finding after you accept one finding for remediation.
• Export or track findings to create JSON, CSV, SARIF, an approval-gated Linear, GitHub, or Jira issue, or a private draft GitHub Security Advisory.
• Write vulnerability reports to turn supplied findings, disclosure notes, source, and PoCs into self-contained reports.
• Propose security hardening to consider structural or architectural options based on scan results or other security evidence.