How to import Dependabot alerts with Codex Security CLI

The Codex Security CLI can import findings from other scanners and save them locally or publish them to Cloud (Daybreak). Scanner imports have been on by default since 0.9.1 (November 10), and the official docs added a dedicated import guide on November 12. This example uses GitHub Dependabot alerts.

1. Export the Dependabot alerts. With a token that has Dependabot alerts read access, fetch every page of GET /repos/OWNER/REPO/dependabot/alerts?per_page=100 and save each page as one compact JSON array per line. Keep the file in a private path outside the repository.

2. Preview before saving.

npx @openai/codex-security publish findings /path/to/dependabot.jsonl \
  --to local --repository ./project --provider github \
  --source-key github.com/OWNER/REPO/dependabot --dry-run --format json

Use the same --source-key every time so repeat imports update the same alerts. If the checkout has network remotes, one must match the alert repository.

1. Run it again without --dry-run to save, then list what was imported.

npx @openai/codex-security publish findings /path/to/dependabot.jsonl \
  --to local --repository ./project --provider github \
  --source-key github.com/OWNER/REPO/dependabot

npx @openai/codex-security findings imported ./project --format json

Imported findings start as not_assessed. Repeat imports keep existing findings that the new report omits. When only some records are excluded, the preview exits with 0 and the import exits with 1; if all records are excluded, both exit with 2.

1. To share with your team, switch to --to cloud, pass the connected repository URL or Cloud ID to --repository, and preview again with --dry-run --format json. A cloud preview needs a file-backed ChatGPT login. A privateImport entry saves findings to your private inbox, while entries in requests publish to the repository environments listed there. Check the destination before removing --dry-run.