The Security workbench brings your scans, findings, and repositories together in the Codex desktop app. Codex performs scan analysis in a regular task, while the workbench keeps the scan and its results available when you return.
Install and enable the Codex Security plugin, then select Security in the desktop-app sidebar.
If Security doesn’t appear, confirm that the plugin is installed and enabled. Update the desktop app and plugin if needed, and check whether your workspace administrator allows the plugin.
Start a scan
For the best scan quality, use gpt-5.6-sol
with xhigh reasoning effort.
- Open Scans and select + Scan.
- Select an existing repository or choose another folder.
- Choose Codebase to scan a repository or Changes to review a Git-backed change.
- For a standard codebase scan, select the entire repository or a folder.
- For a deep scan, first select the repository or folder as the codebase, then turn on Deep scan. Deep scans review the entire selected codebase.
- For a changes scan, select uncommitted changes, a commit, or a revision range. Deep scan isn’t available for changes scans.
- Choose a model and reasoning effort. Open Additional context to describe relevant attack vectors, focus areas, or other security context.
- Select Start scan.
Choose a repository and configure a scan in the Security workbench.
See Run a security scan, Run a deep security scan, or Review code changes for security for details about each scan type.
Follow scan progress
The scan page shows the current phase and any scan progress the plugin reports. For a standard scan, phases include threat modeling, discovery, validation, impact and path analysis, reporting, and finalization.
Select View activity to open the Codex task that runs the scan. You can leave the workbench and return to Scans without losing a saved scan. To stop work intentionally, open the scan and select Stop scan.
When the scan completes, open its results to review the target, revision, findings, coverage, and available report artifacts.
Review findings, severity, scan coverage, and artifacts after a scan completes.
Review findings across scans
Open Findings to inspect saved findings across repositories and scans. Search or filter the list, then select a finding to review its summary, source evidence, validation, and impact.
Use Summary for the finding details and Patch when you want to generate, review, apply, or verify a focused fix. See Fix and verify security findings for the remediation workflow.
The Findings tab shows findings from saved Codex Security scans. Imported tickets and other existing security issues remain part of the separate backlog triage workflow.
Inspect repository history
Open Repositories to browse available repositories and folders. Select a repository to inspect its scan history, latest scanned revision, and open findings. From repository details, open a previous scan or view the findings associated with that repository.
If a repository has no scans, start a scan from its details or select + Scan in the workbench.
Start a scan from a conversation
You can also ask Codex to run the installed Codex Security plugin in a regular conversation. Scans that use the shared plugin workbench appear in Scans, so you can return to their progress and results from the Security workbench.
For terminal-based scans and automation, see the Codex Security CLI quickstart.