How to find security vulnerabilities in a repo with Codex Security CLI Deep Scan

OpenAI's Codex Security CLI 0.9.1 (November 10) reworked Deep Scan. It runs Standard scans in batches across several workers; workers share the leads they're investigating and check each other's evidence. The final report groups findings that share the same fix and keeps every source location each review found.

1. Install and sign in, with a ChatGPT account or an API key.

npm install --global @openai/codex-security
cs login

cs is the short alias for codex-security.

1. Run a deep-mode scan from your repository folder.

cs scan . --mode deep --workers 2 --subagents 0 \
  --stop-after-no-new 3 --max-discovery-runs 10 --max-time 90

--workers is the number of Standard scans per batch and --subagents the subagents per scan. --stop-after-no-new sets how many consecutive scans with no new findings end the run, and --max-discovery-runs caps the total scans started, failures included. --max-time is in minutes; in Deep Scan the limit is enforced, and both the default and the maximum are 5760 minutes (96 hours). When time runs out, you get the findings from completed scans.

1. When the scan finishes, open the Markdown report at the REPORT path.

As of 0.9.1, --stop-after-no-new counts consecutive completed Standard scans that added no findings, so if a script depends on a particular run length, revisit it together with --max-discovery-runs and --max-time. External scanner imports (Semgrep, Snyk, Trivy and others) are now on by default, so remove CODEX_SECURITY_ENABLE_EXTERNAL_IMPORTS from launch scripts.