Use the Codex Security Cloud plugin to scan connected GitHub repositories, review findings, and monitor new commits.
Codex Security Cloud runs scans in Codex cloud. For scans of a local repository in the desktop app or CLI, use the separate Codex Security plugin.
1. Install and open the plugin
- Open Plugins in ChatGPT on the web or in the desktop app.
- Search the plugin marketplace for Codex Security Cloud.
- Install and enable the plugin, then open Security Cloud from your installed plugins or sidebar.
If access is unavailable, check with your workspace administrator.
2. Connect GitHub
Confirm that Codex cloud is set up for your workspace. In the plugin, select Scan. If prompted, select Connect GitHub and grant access to the repositories you want to scan.
If a repository is missing, check its GitHub connection and permissions.
3. Start a repository scan
- In New Scan, choose the repository.
- Review the environment. Auto creates an environment when you start. Use Customize to choose an existing environment. See Codex cloud environments for setup details.
- Under Scan Method, select One-Time Scan.
- Select Create.
Open the scan in Scans to follow its progress and review its findings and artifacts.
4. Review findings and available fixes
Open Findings. Use Open findings to review findings with a New, Triaged, or In Progress status. Search the list or use Filters to narrow the results. The Severity and status chart summarizes the matching findings.
Filter and review open findings. Repositories, findings, and counts are fictional and match the overview example.
Select an issue to review its affected code, validation evidence, and remediation guidance.
When a finding offers Fix with Codex, select it to generate a proposed patch. Review the patch before selecting Create draft pull request.
5. Monitor new commits
To review changes as new commits arrive:
- Select Scan, then choose the repository and review the environment.
- Under Scan Method, select Continuous Scanning. Codex Security scans the repository’s default branch.
- Choose Scan commit history from. Longer windows provide more context, but the initial scan takes longer.
- Optionally add threat model scoping guidance.
- Select Create.
Configure continuous scanning. The repository shown is fictional.
To adjust monitoring, open Repositories, select the repository, and open Monitoring settings. You can change the Cloud environment, choose how many days of history to review, and pause or enable monitoring. Select Save to apply changes.
Review and edit the generated threat model under Project context, then select Save. See Improving the threat model for guidance.
Related docs
- Codex Security gives the product overview.
- Codex Security Cloud FAQ covers common Cloud questions.
- Improving the threat model explains how to improve scan context and finding prioritization.
