Codex Security Review (Research Preview)

Codex reviews GitHub pull requests specifically for security problems and posts findings into the pull request.

It reads the pull request diff alongside repository context and a threat model, then reports findings with severity, the attack path, supporting evidence, and a suggested fix
You configure in Codex settings which pull requests get reviewed, whether reviews run on open or after each push, and where the threat model comes from
High and critical findings post automatically to the pull request, medium and above post on manual runs, and the full report stays in the Codex task under a Security Report tab
Available on ChatGPT Enterprise, Business, Edu, and Pro, not on Plus
Usage limits may apply but it does not consume credits during the research preview
Findings on public repositories are visible to anyone viewing the pull request