# Codex Security (ChatGPT Plugin)

> Security scanning for your codebase

- Type: plugin
- Publisher: OpenAI (official)
- Categories: Security, Development
- Website: https://github.com/openai/plugins/tree/main/plugins/codex-security
- Docs: https://learn.chatgpt.com/docs/plugins
- Source: https://github.com/openai/plugins
- Open in ChatGPT: https://chatgpt.com/plugins/Plugin_1e648473be9c8191a91ac3947151af55
- GitHub stars: 7248
- Listed: 2026-04-30

## About

Codex Security workflows for security scans, analysis, and investigation. Skills cover security scans, diff scans, deep scans, threat modeling, finding triage, fix proposals and verification, vulnerability write-ups and patch-risk assessment. Listed in OpenAI's curated Codex marketplace (openai-curated); the manifest declares skills, an app connector and MCP server config.

## Install

1. **Add it in ChatGPT** Open Plugins in the ChatGPT sidebar (web or desktop), search for “Codex Security” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.

2. **Or install it in Codex**

   Codex CLI:

   ```bash
   codex plugin add codex-security@openai-curated
   ```

## Skills

- **Assess Patch Risk**: Assess patch impact and merge risk
- **Attack Path Analysis**: Perform attack-path analysis for a security finding
- **Deep Security Scan**: Run a deeper security scan
- **Define Security Policy**: Define scoped SECURITY.md scan guidance
- **Finding Discovery**: Discover security findings
- **Fix Security Finding**: Fix and verify a given security finding
- **Propose Security Hardening**: Design evidence-backed security hardening options
- **Security Diff Scan**: Run security review on a Git diff
- **Security Scan**: Run repository or scoped-path security scan
- **Threat Model**: Build a repository threat model
- **Track Findings**: Track findings in Linear, Jira, GitHub issues, or draft advisories
- **Triage Finding**: Triage existing security findings from reports, GitHub, Jira, or Linear
- **Validation**: Validate a security finding
- **Verify Fix**: Verify security fixes without changing code
- **Vulnerability Writeup**: Write up a vulnerability into a polished, self-contained, source-backed report.

## Example prompts

- "Run a Codex Security scan on this repository."
- "Run a Codex Security diff scan on this PR, commit, branch diff, or working-tree patch."
- "Triage existing security findings against this repository."

## Also available as

- app: [MCP App Basics (Apps SDK example)](https://chatgptplugins.directory/apps/apps-sdk-mcp-app-basics.md)
- MCP server: [OpenAI Docs MCP](https://chatgptplugins.directory/mcp/openai-docs.md)

## Related

- [Superpowers](https://chatgptplugins.directory/plugins/superpowers.md): Plan, develop, and debug code
- [Build Web Apps](https://chatgptplugins.directory/plugins/build-web-apps.md): Build frontend-focused web apps with generated assets, browser testing, payments, and...
- [GitHub](https://chatgptplugins.directory/plugins/github.md): Triage PRs, issues, CI, and publish flows
- [Figma](https://chatgptplugins.directory/plugins/figma.md): Figma design-to-code workflows
- [Shopify](https://chatgptplugins.directory/plugins/shopify.md): Build and manage your store
- [PostHog](https://chatgptplugins.directory/plugins/posthog.md): Analyze your product data

---
Source: https://chatgptplugins.directory/plugins/codex-security · Index: https://chatgptplugins.directory/llms.txt · Independent and community-run. Not affiliated with or endorsed by OpenAI. ChatGPT is a trademark of OpenAI.