Security Review is available in research preview. It is available to ChatGPT Enterprise, Business, Edu, and Pro customers; it is not available on Plus. During the introductory period, Security Review does not consume ChatGPT credits. Usage limits may apply.
Security Review is an additional review for customers that want to pay particular attention to security issues in pull requests.
Security Review goes deeper than Code Review on security-specific risks by analyzing the pull request diff, supporting repository context, and configured threat models or security guidance. Code Review can also identify security-related issues as part of its general review, so you may see occasional overlap between findings.
Before you start
To configure automatic Security Review, you need:
- Security Review research preview access for your workspace
- Codex cloud set up with a connected GitHub repository
- GitHub push or admin permission for the repository settings
An existing Codex Security scan is optional.
Configure Security Review
- Go to Codex settings.
- Under Repository preferences, choose which pull requests get Security
Review:
- Follow personal lets each contributor opt in with their personal Security Review settings.
- Review all PRs applies to every pull request in the repository.
- Review team PRs, when available, applies to pull requests opened by members of your ChatGPT workspace, not members of a GitHub team.
- Choose when Security Review runs:
- On PR open runs independently when a pull request is opened.
- Every push runs independently after new commits are pushed.
- Whenever code review runs requires Code Review and runs Security Review alongside it.
Add threat-model context
You can configure a threat model to give Codex context about your application’s assets, trust boundaries, security assumptions, and repository-specific risks. If the repository has an existing Codex Security scan configuration, you can use its threat model. Otherwise, provide the path to a threat model file checked into the repository. If you do not specify a source, Codex regenerates the threat model for every review.
Set reporting thresholds
By default, automatic Security Reviews report High and Critical findings, while manually requested reviews report Medium, High, and Critical findings. You can change the minimum severity independently for automatic and manual reviews, and add path-based overrides.
Findings posted to a pull request inherit that pull request’s GitHub visibility. Anyone who can view the pull request can view those findings, including on public repositories or pull requests from contributors outside your workspace. Choose reporting thresholds carefully for repositories where pull request comments may be broadly visible. The reporting threshold controls what Codex posts to GitHub; the full Security Review report remains in Codex.
Request a Security Review
To request a Security Review manually, add this comment to a pull request:
@codex security review
Codex reacts while the review is running, then posts findings that meet your manual reporting threshold directly on the pull request. Open the associated Codex task and select the Security Report tab to view the full report, including severity, attack path, supporting evidence, validation, and remediation guidance. If no issues meet the reporting threshold, Codex does not post findings to the pull request.
Related docs
- Review GitHub pull requests with Codex explains Code Review and the GitHub integration.
- Codex Security gives the product overview.
- Codex Security cloud setup explains repository scans and findings review.
- Improving the threat model explains how to tune repository context.