Summary
In this OpenAI tutorial, Dan Shanahan of the cyber deployment engineering team demonstrates how to use Codex security reviews to catch vulnerabilities in pull requests before they reach production. The video starts in GitHub, where he verifies that the ChatGPT Codex connector app is installed, and notes that workspace administrators and repository owners may need to help with setup.
Shanahan first runs a manual review by tagging Codex in a pull request comment. Codex returns a summary of its findings, including a cross-site scripting issue. He then passes the PR link to Codex, which writes a fix and pushes the commit to the pull request, and a follow-up review confirms that no issues remain.
The second half shows how to automate the process. In the Codex app’s code review settings, he configures personal security review preferences, then switches to repository-wide reviews so every new pull request is scanned automatically. Options include running on PR open or on every push, and setting severity thresholds for manual and automatic alerts. He also points to AGENTS.md and security.md files, which give Codex repository-specific guidance. The demo ends by opening a pull request on a pre-staged branch with known vulnerabilities to show the automated scan in action.
📺 Source: OpenAI · Published November 11, 2026
🏷️ Format: Tutorial Demo
