Codex Security plugin quickstart

Install the Codex Security plugin, run a standard scan of a local repository, and review its findings. The scan leaves your source unchanged and saves a report with evidence and remediation guidance.

Install the plugin

Run your first scan

For the best scan quality, use gpt-5.6-sol with xhigh reasoning effort.

1. Open the scan setup

   Select Security in the sidebar, open Scans, and select + Scan.

2. Choose the codebase and scan area

   Select an existing repository or use another folder. Choose Codebase, leave Deep scan off, and select the entire repository or one folder. Confirm that the branch and revision identify the code you intended to scan.

3. Add security context

   Choose the model and reasoning effort. Open Additional context only when you need to describe an attack vector, security-sensitive area, or repository detail that should guide the review.

   

4. Start the scan

   Select Start scan and follow the scan phases in the Security workbench. Select View activity to inspect the Codex task that performs the scan.

5. Review the result

   Open the completed scan to inspect findings, coverage, and available report artifacts. Use Findings to review issues across scans or Repositories to inspect a repository’s scan history.

   

Interpret the result

Check the target and revision first. Then read which areas were reviewed and which were deferred. A completed scan can still have coverage gaps. A review that reports no findings hasn’t necessarily ruled out every vulnerability.

Open a finding and read its source evidence, attacker prerequisites, validation, and remaining uncertainty. Validation can use source analysis without running a reproducer. Use the recorded method and evidence to decide whether the issue applies to your system.

What the scan creates

In the desktop app, completed scans remain in Scans. In Codex CLI, use the scan directory reported in the conversation. Open report.md for the readable result. Detailed vulnerability reports under findings/ and design proposals under hardening/ are optional outputs you can request.

The directory also contains scan-manifest.json, findings.json, and coverage.json for tools and automation. Keep it together when sharing or archiving results so the report’s links continue to work.

Choose your next workflow

• Configure scope and security context for the next scan, or review a code change.
• Fix and verify a finding after you accept its evidence, or track it in an issue.

For other scan modes and workflows, return to the Codex Security overview.