How to enable PR security reviews with Codex Security
Install the Codex GitHub app, then enable repository-wide security reviews for all PRs to catch vulnerabilities before merge.
- Confirm the Codex GitHub app is installed; ask a workspace admin or repo/org owner if you lack access.
- In Codex settings, enable repository security reviews, set cadence to “all PRs,” and choose open-only or every-push triggers.
- Use PR comments to request a review; ask Codex to fix findings, then run another review to verify the change.
The walkthrough shows the GitHub and Codex settings and a complete PR review-and-fix flow. · Best for: GitHub repository owners and developers configuring automated PR security reviews.
Demonstrates how to set up manual and automatic Codex security reviews for GitHub pull requests, fix a finding, and check the result with another review.
Check the GitHub app installation0:00
- In the repository, open Settings and GitHub Apps to confirm the Codex connector is installed and configured.
- If the app is unavailable, ask a workspace administrator or GitHub repository or organization owner to install it.
Request a manual review and fix a finding1:10
- Comment on a pull request and tag Codex to request a security review; findings appear in the PR.
- Share the PR link with Codex and ask it to repair a finding. The demo fixes a cross-site scripting issue and publishes a commit.
- Request another review to check the fix; the demo reports no issues found.
Configure review preferences3:13
- In the Codex app, open Settings and scroll to Code review.
- Personal security review preferences apply to PRs opened by you; triggers can be PR opening or every push.
- For repository-wide coverage, enable security reviews for the repository, set cadence to all PRs, and choose the trigger and alert thresholds.
- Agent markdown and security MD files can provide repository-specific instructions.
Test an automated repository review5:11
- Open a new PR in the configured repository; the security review starts automatically and findings appear in the PR.
Step by step
- Confirm the Codex GitHub app is installed and configured for the repository.
- For a manual scan, comment on a PR and tag Codex to request a security review.
- To address a finding, give Codex the PR link and ask it to fix the issue; review the resulting commit.
- Run another security review to verify the change.
- For automatic reviews, open Codex Settings > Code review, enable repository security reviews, set cadence to all PRs, and choose the trigger and alert thresholds.
Tools & resources mentioned
- GitHub — repository settings, GitHub Apps, and pull requests.
- Codex GitHub app — connector used for PR security reviews.
- Codex Code review settings — configure personal or repository review preferences, cadence, triggers, and alert thresholds.
- Agent markdown and security MD files — repository instruction files for guiding Codex reviews.
Notes are AI-generated from the video's transcript and may miss nuance.