Your first Codex Security scan, step by step

What Codex Security does

Codex Security is OpenAI’s security reviewer for code. It comes as a plugin for the Codex app and the Codex CLI, and as an open-source command-line tool, @openai/codex-security, under the Apache-2.0 licence (GitHub, vendor). A scan maps the codebase, builds a threat model, reviews the code, checks each candidate finding, and can propose a patch.

Daybreak is OpenAI’s access programme for approved security teams. Daybreak Blue covers defensive work such as vulnerability triage and patch validation. Daybreak Red covers exploit validation and red teaming and needs separate approval (OpenAI, vendor). OpenAI says most defensive work can start without either. Blue is not a prerequisite for your first scan.

OpenAI supplies the scanner. Scope, permissions, and the merge decision stay with you.

Before you start

Part 1: run your first scan

1. Step 1. Install the plugin. In Codex, open Plugins, search for Codex Security, and install it. Confirm it is enabled, then open Security in the sidebar (OpenAI quickstart, vendor). In the Codex CLI, run codex in the repository, enter /plugins, install, then /new.
2. Step 2. Start a scan. Select Security, then Scans, then + Scan, and pick the repository.
3. Step 3. Keep the first scope small. Choose Codebase, leave Deep scan off, and select the whole repository or one folder. Confirm the branch and revision. In a monorepo, pick one service that has an owner and a clear security boundary.
4. Step 4. Choose the model. OpenAI’s docs recommend gpt-5.6-sol at xhigh reasoning. In the video, an account with Daybreak Blue access selects Blue instead.
5. Step 5. Add context. Open Additional context and name the attacker-controlled inputs, trust boundaries, sensitive actions, and the area to prioritise. The video points the scan at the authentication service. OpenAI says this guidance drives more accurate results.
6. Step 6. Start the scan. Select Start scan and use View activity to follow it as it maps the code, builds the threat model, and narrows candidates to findings.

Part 2: read the results before you trust them

• Confirm the target. Check the repository, branch, and revision the report names.
• Read coverage first. The report lists reviewed areas and deferred areas. OpenAI says a completed scan can still have gaps, and zero findings does not prove the code is safe (OpenAI, vendor).
• Test each finding. Read the attacker’s path, the control that failed, the impact, the evidence, and what remains uncertain. Validation can rest on reading the source without running an exploit.
• Dismiss with a reason. A dismissal needs an explanation, and the explanation stays with the finding.
• Keep the files together. Each scan writes report.md, findings.json, coverage.json, and scan-manifest.json. Move the folder as one unit so the report’s links keep working.

Part 3: fix and verify one finding

7. Step 7. Generate a patch. Open an accepted finding, select the Patch tab, then Generate patch. This writes a patch file and does not touch your checkout (OpenAI, vendor).
8. Step 8. Review the diff. It should change only the affected code and its tests. Reject unrelated refactors and anything that weakens a security control.
9. Step 9. Apply the patch. Select Apply patch. Your working tree now changes, so review that diff too.
10. Step 10. Verify the fix. Select Verify fix. Codex reruns the original check, adds a regression test where it can, and looks for nearby bypasses and broken legitimate behaviour. Gaps are recorded.
11. Step 11. Merge through your normal review, then close the finding yourself. Verification does not close it. Choose an accurate reason, or leave it open with the remaining work.

The video sends the fix to GitHub straight after reading the diff. OpenAI’s current docs put Verify fix in between. Keep that step: a patch is not a fix until it has been checked.

Part 4: repeat it every week in CI

12. Step 12. Install the CLI. cs and codex-security run the same tool.

    npm install --global @openai/codex-security

13. Step 13. Sign in. On a laptop run cs login, or cs login --device-auth on a remote machine where your workspace allows it. In CI, set OPENAI_API_KEY or CODEX_API_KEY from a secret (GitHub, vendor).
14. Step 14. Run it locally first.

    cs scan .                                       # whole repository
    cs scan . --path src                            # one folder
    cs scan . --diff origin/main                    # only committed changes
    cs scan . --mode deep                           # deep scan
    cs scan . --cyber-access-program daybreak_blue  # only with Blue access

    Without Blue, leave the last flag out or set it to standard.
15. Step 15. Schedule it in report-only mode. This is OpenAI’s published workflow, trimmed. Replace the placeholder with the full commit SHA of a release you have reviewed, and store the key as a repository secret.

    name: Codex Security
    on:
      workflow_dispatch:
      schedule:
        - cron: "23 7 * * 1"   # Mondays 07:23 UTC
    permissions:
      contents: read
    jobs:
      security:
        runs-on: ubuntu-24.04
        steps:
          - name: Set up the Ubuntu sandbox
            run: |
              sudo apt-get update
              sudo apt-get install --yes bubblewrap apparmor-profiles
              sudo apparmor_parser -r /usr/share/apparmor/extra-profiles/bwrap-userns-restrict
          - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
            with:
              persist-credentials: false
          - uses: openai/codex-security@REPLACE_WITH_REVIEWED_COMMIT
            with:
              model: gpt-5.6-sol
              effort: high
              cyber-access-program: standard   # daybreak_blue if approved
            env:
              OPENAI_API_KEY: ${{ secrets.CODEX_SECURITY_API_KEY }}

16. Step 16. Gate merges only after a few clean runs. Findings are report-only by default. Once the team trusts the output, add a severity gate such as --fail-on-severity high on diff scans (Flavio Copes, independent).

Where this breaks

• Results vary between runs. A finding that disappears from the next scan is not proof it was fixed (Flavio Copes, independent).
• Local scans act with your permissions. They do not pause for approval (OpenAI, vendor). Run them on a machine with no unrelated credentials.
• Cost needs a cap. --max-cost limits spend, and requests already running can take it slightly over (independent).
• Data handling is not in the scan docs we read. Ask OpenAI what leaves the machine before you scan regulated code.

Missing

• A Prestanda measurement. We have not run a scan for this note; the steps follow OpenAI’s documentation and walkthrough video.
• Pricing and plan eligibility for Codex Security. OpenAI’s help article was unreadable from our environment.
• A published false-positive rate.
• The exact SARIF export command. The README lists SARIF export, but no source we read shows the flag.