Scan, patch and verify with openai/codex-security

Code review rarely has time to chase every attacker-controlled input to the operation it controls. The README describes a tool that scans repositories, selected paths or Git changes, validates candidate findings, generates patches and verifies existing fixes. Results are saved locally, and can be exported as SARIF, JSON or CSV for tracking.

• Match scope to the question: cs scan . --path src --path tests for selected paths, cs scan . --diff origin/main for committed changes (README, Scan options).
• Reserve --mode deep for when you want repeated audits; deep scans repeat Standard scans and return deduplicated findings (README, Features).
• Keep a SECURITY.md: scans already use root and component files, and cs policy . drafts one outside the repository (README).
• Read the report's source evidence and coverage limits, and check scan.review.excludedPaths in scan-manifest.json for exclusions (docs/agent-workflows.md).
• In CI, set OPENAI_API_KEY or CODEX_API_KEY in the scan process environment, and pin the GitHub Action to a reviewed commit SHA (README).
• Treat repository content and model output as data, not instructions (the repo's AGENTS.md).

On a throwaway branch, run cs scan . --diff origin/main, open the report, and for one finding note its source lines and the coverage limits. Then run cs export --scan SCAN_ID --artifact threat-model --output threatmodel.md to save the threat model.

• Requests in progress can exceed the Action's cost limit; it is an estimated threshold, not a hard cap.
• Some cybersecurity requests and protected findings require Trusted Access for Cyber (README).
• cs policy leaves your existing SECURITY.md unchanged; you must review and copy the draft yourself, preserving vulnerability-reporting instructions.
• The local serve command and browser dashboard have been removed; existing databases and artifacts remain available.

• README
• Agent workflows and recovery
• CLI reference
• GitHub Action guide
• Project configuration