Codex Security Review (Research Preview)

Codex reviews GitHub pull requests specifically for security problems and posts findings into the pull request.

It reads the pull request diff alongside repository context and a threat model, then reports findings with severity, the attack path, supporting evidence, and a suggested fix
You configure in Codex settings which pull requests get reviewed, whether reviews run on open or after each push, and where the threat model comes from
High and critical findings post automatically to the pull request, medium and above post on manual runs, and the full report stays in the Codex task under a Security Report tab
Available on ChatGPT Enterprise, Business, Edu, and Pro, not on Plus
Usage limits may apply but it does not consume credits during the research preview
Findings on public repositories are visible to anyone viewing the pull request

Catching security issues in a pull request before it merges, without waiting on a dedicated security reviewer.

Your team ships code faster than security can review it and you want a first pass on every pull request.

Engineering teams on ChatGPT Enterprise, Business, Edu, or Pro plans.

Join the newsletter to get ahead with AI.

I share strategies, new modules, free guides, and tools to get you better at using AI in your work.