Codex Security puts vulnerability scanning, patch generation and fix verification in one workflow, callable from the command line and CI

Code security review can start inside a Codex session, or run automatically through a command-line tool or the TypeScript SDK, covering whole repositories, selected paths and Git changes. The same security workflow spans four entry points, the Codex plugin, the command line, the SDK and a GitHub Action, and the short command name cs and codex-security run the same tool. After a global install, cs login signs in and cs scan . in the repository directory starts a scan; when it completes the terminal shows the path of the report file, and cs scans show in the same repository finds the latest completed scan again.

A scan does more than list suspicious spots: it can validate candidate findings, generate patches and check whether an existing fix holds. A standard scan produces a list of findings, while a deep scan repeats the standard scan and returns deduplicated findings, merging repeats before presenting them. The report records source evidence and exclusions, which the user reads to judge coverage before requesting a patch or asking Codex to verify an existing fix.

Findings can be assessed for severity against the user's own rubric, with owners suggested from source and Git history, then tracked in Linear, Jira or GitHub or exported as SARIF, JSON or CSV. Third-party scanner findings can be previewed and saved locally first, and supported reports can then be published to Codex Security Cloud. Scans use the existing SECURITY.md guidance at the repository root and for each component, and that file can be drafted or revised and threat models saved for later review.

The demonstrated scope is product usage: start a scan from a Codex session with the plugin enabled, or install the command line and scan a repository, selected paths or Git changes from a terminal, or connect automation through the TypeScript SDK and GitHub Action. Running it requires Node.js 22.13.0 or later within 22.x, or Node.js 24.x or 26.x, plus Python 3.10 or later, with tomli also needed for Python 3.10. Some cybersecurity requests and protected findings require Trusted Access for Cyber.

A deep scan is described as repeating a standard scan and returning deduplicated findings, and its timing and scale limits must be checked in separate documentation. Scan reports include exclusions, so coverage can only be determined by reading the report. Some requests and protected findings are gated by Trusted Access for Cyber, and accounts with Daybreak access must select a program explicitly.