Codex Security plugin quickstart
Install the Codex Security plugin, run your first read-only scan, and review the result in Codex.
Codex Security scans your code for vulnerabilities and validates plausible findings. For each reportable issue, it gives you the evidence and remediation guidance you need to review the result. Scan only code you own or have permission to assess.
Follow this quickstart to install the plugin and run a read-only scan of a local repository in Codex.
Install the plugin
- Open Codex in the ChatGPT desktop app.
- Open Plugins, search for Codex Security, or select Install the Codex Security plugin.
- Confirm the plugin is enabled, then open Security in the sidebar.
- In your terminal, go to the repository you want to assess and start Codex:
codex- Enter
/plugins, search for Codex Security, and select Install plugin. - Enter
/newto start a new chat for the repository.
Run your first scan
For the best scan quality, use gpt-5.6-sol
with xhigh reasoning effort.
Open the scan setup
Select Security in the sidebar, open Scans, and select + Scan.
Choose the codebase and scan area
Select an existing repository or use another folder. Choose Codebase, leave Deep scan off, and select the entire repository or one folder. Confirm that the branch and revision identify the code you intended to scan.
Add relevant context
Choose the model and reasoning effort. Open Additional context only when you need to describe a specific attack vector, security-sensitive area, or repository detail that should guide the review.
Turn on additional context to describe attack vectors, focus areas, and relevant security guidance. Start the scan
Select Start scan and follow the scan phases in the Security workbench. Select View activity to inspect the Codex task that performs the scan.
Review the result
Open the completed scan to inspect findings, coverage, and available report artifacts. Use Findings to review issues across scans or Repositories to inspect a repository's scan history.
Review scan results, findings, and coverage in the Security workbench.
Ask for an ordinary scan
Send this prompt in the new chat:
Run a Codex Security scan on this repository.Let the scan finish
Codex runs the scan in the terminal without opening a setup workspace. Keep the task running until Codex reports that it is complete. If Codex identifies a configuration limitation, review the limitation and the exact proposed change before you approve a configuration update.
Review the result
Review the summary in the terminal, then open the generated
report.mdfor the complete result.
What the scan creates
Completed scans remain available in Scans. Review their findings and coverage in the Security workbench, or inspect related findings and repository history in Findings and Repositories. The scan also creates the files below.
Every completed scan reports a summary in the terminal and creates the files below.
report.md, the primary readable entry point to the scan results.findings/<slug>/, when detailed vulnerability reports and supporting proof-of-concept files are available.hardening/, when structural hardening guidance and supporting proposals or diagrams are available.- Structured scan data in
scan-manifest.json,findings.json, andcoverage.jsonfor automation and integrations. You normally don't need to open these files yourself.
Keep the full scan directory together when sharing or archiving results so the
links from report.md continue to work.
Choose your next workflow
- Use the Security workbench to manage saved scans, findings, repositories, and scan activity in the desktop app.
- Run a scan from the CLI if you have beta access and need a repeatable terminal workflow with structured results.
- Run a standard or scoped scan when you want to scan a repository or one folder with the default workflow.
- Run a deep scan when you need a more comprehensive scan and can wait longer for it to finish.
- Review code changes when the target is a pull request, commit, branch range, or working-tree patch.
- Triage a backlog when you have existing security findings to review.
- Fix and verify a finding after you accept one finding for remediation.
- Export or track findings when you need JSON, CSV, SARIF, an approval-gated Linear, GitHub, or Jira issue, or a private draft GitHub Security Advisory.
- Write vulnerability reports when you want to turn supplied findings, disclosure notes, source, and PoCs into polished, self-contained reports.
- Propose security hardening when you want structural or architectural options based on scan results or other security evidence.