Tech • AI • Robotics • Game
How to enable PR security reviews with Codex Security
TL;DR
Codacy security pull request reviews in GitHub can be run manually or automatically to detect vulnerabilities before code is merged, then paired with Codex to propose and verify fixes.
KEY POINTS
GitHub app setup
The workflow starts by installing and configuring the ChatGPT Codacy connector in a GitHub repository. If the app is not available, access typically requires coordination with a workspace administrator and the repository or organization owner.
Manual security review in a pull request
A developer can request a review directly inside a pull request by tagging Codacy in a comment and asking for a security scan. After completion, Codacy posts a summary in the discussion and surfaces findings within the pull request for direct inspection.
Fixing vulnerabilities with Codex
Once a finding appears, the pull request link can be sent to Codex with instructions to repair the reported issue. In the demonstrated case, Codex analyzed the repository, generated a code change to address a cross-site scripting vulnerability, and published the fix back to the same pull request as a commit.
Verification through a second review
The remediation step is followed by another security review request to confirm the fix. After the new scan completed, the pull request returned a clean result stating that no issues were found.
From on-demand scans to automation
The process can move beyond manual checks through the Codex app settings. Under the code review section, users can enable personal security review preferences so their own pull requests are scanned automatically instead of waiting for an explicit comment request.
Trigger and severity controls
Review settings allow teams to define when scans run, either when a pull request opens or on every push to an existing pull request. They can also set thresholds for manual and automatic alerts so notifications are limited to the desired severity level.
Repository-wide enforcement
Personal settings affect only pull requests opened by a specific user, but repository settings can extend the same protection to all contributors. By switching review cadence to all PRs, a repository can ensure every newly opened pull request receives an automatic security scan regardless of who created it.
Automated review in action
In the demonstrated repository-level setup, a newly created pull request containing known vulnerabilities triggered an automatic Codex security review without any manual prompt. The analysis appeared in the pull request shortly after creation, showing how the system can surface issues early in the development cycle.
Custom guidance through repository instructions
The setup also supports repository instruction files such as agents markdown and security MD files. These files can provide project-specific guidance so the review system better understands the repository’s conventions and security expectations.
CONCLUSION
The workflow combines automated detection in GitHub with AI-assisted remediation to shorten the time between discovering a flaw and confirming a fix. Used at repository scale, it can help teams catch vulnerabilities before they become production-facing risks.
Ask a question