The problem
How it works
OpenAI’s six-minute video and the matching documentation walk through Codex Security Review. With a GitHub repository connected to Codex cloud, you either comment @codex security review on a pull request or switch on automatic reviews in Codex settings. The repository’s Review setting chooses which pull requests are checked (every one, those from workspace members, or each contributor’s own choice), and Trigger chooses when: when a pull request opens, on every push, or together with general code review. You can point it at a threat model file in the repository and set separate minimum severities for automatic and manual reviews; by default automatic reviews post only High and Critical findings. The full report, with attack path, evidence, validation and fix advice, stays in Codex.
Results and limitations
This is a vendor tutorial with no reported results, so it is marked planned.
Before you try it
Findings posted on a pull request are visible to anyone who can see it, including on public repositories, so think before enabling it where undisclosed issues could leak. An empty result does not always mean no findings: OpenAI says to check the task status and full report. Reviews use Codex allowance or credits and need a Business, Enterprise, Edu or Pro plan, not Plus. Results depend on your setup and were not independently reproduced by Top 200 Repos.
Tools and repositories
No ranked repository is involved. This use case still stands on its own source.
- Tools
- Codex cloud · GitHub
- Prerequisites
- A ChatGPT Business, Enterprise, Edu or Pro plan with Codex Security Review, and push or admin rights on the repository.
Try it yourself: Write a threat model the reviewer can use
Fill the fields to adapt the prompt. Empty fields stay as visible [placeholders].
Draft a short threat model for [Repository] that an automated security reviewer can read. The app [What the app does]. Sensitive assets: [Sensitive assets]. Trust boundaries: [Trust boundaries]. List the main entry points, what an attacker would want, the assumptions the code relies on and which folders matter most, in under one page of Markdown.Commit the file to the repository and point the review settings at its path.
Sources
- How to enable PR security reviews with Codex Security (opens in a new tab)
Vendor post · youtube.com · Published 11 Nov 2026 · Source checked 13 Nov 2026, 19:26 UTC
What this source supports
- Shows checking the GitHub connection, requesting a review, working through a fix and reviewing the change again
- Configures automatic reviews per repository with triggers and severity thresholds
- Security Review (opens in a new tab)
Project documentation · learn.chatgpt.com · Undated · Source checked 13 Nov 2026, 19:28 UTC
What this source supports
- Available to ChatGPT Enterprise, Business, Edu and Pro, not Plus; reviews consume Codex allowance or credits
- Review policy (personal preferences, all PRs, team PRs) and Trigger (on open, every push, with code review)
- Manual request by commenting @codex security review; threat-model context can be configured
- Automatic reviews report High and Critical by default; findings inherit the pull request’s visibility
- Check the task status and full report before reading an empty result as no findings