Codex Security 0.2.0: Saved Threat Models and CI Warnings

Ethan Park

Morning, everyone. Thanks to Jellypod for helping make this daily show a reality. Today is Codex Security 0.2.0, published on October 6. If you caught our earlier security episode on 0.1.29, with the markdown severity rubrics and custom patch validation prompts, this release builds on that. The threat model behind those policies now gets saved too.

Maya

Here's the exact change. Threat models are now saved with Standard, Deep, and Diff scan results, and with generated security policies. That's pull request 1133, and the release marks it as a breaking change. The headline command is export. You run codex security export, with the artifact flag set to threat model. Or, if you're in the TypeScript SDK, there's an exportArtifact helper. The release notes say you can export a saved model without another model call.

Ethan Park

That last part is the point. The notes state it plainly: no additional model invocation. What follows is my interpretation, not something the release notes spell out. The threat model becomes something you can store alongside a scan and pull into a PR summary, an audit doc, or a review checklist without paying for another model call to regenerate it. And because it's saved with that scan's results, the text you export is the text that existed when the scan ran.

Maya

Let me walk through the workflow. First, run a scan in one of the three modes. Something like npx, then the at openai slash codex security package, then scan, with the target flag pointing at your source directory. Threat modeling is part of Standard, Deep, and Diff, so there's no extra switch to turn on. Once that finishes, you export. Same package through npx, the export command, the artifact flag set to threat model, and the scan flag with your scan ID.

Maya

In the SDK, you create a client, then await client dot exportArtifact, passing the scan ID and the artifact name, threat model. That returns the saved model. I'd check the SDK types for the exact signature before wiring it into a pipeline, because the shape of what comes back matters a lot in this release, and that's the next part.

Ethan Park

Right, because there are three upgrade notes that affect anything reading these files. First, policy generation now writes a file called threatmodel.md, all lowercase, instead of THREAT_MODEL.md in capitals. The notes tell you to use the returned path rather than hard coding either name. Second, on the SDK side, check SecurityPolicyDraft.threatModelPath for null before you open the file. The notes don't say when it's null, so just guard against it.

Ethan Park

Third, saved models can come back in two forms. One is Markdown, where you get a format field set to markdown plus a content field. The other is the previous structured format. So a reader has to handle both. The good news is that existing models stay readable and exportable without migration. You don't have to rewrite old scans to use the new export.

Maya

Now the caveats, because a few of them could bite you in CI. The one I'd read twice: Codex Security no longer masks diagnostic text that looks like credentials. That's pull request 1179. The notes say CLI output, plus saved error, publication, and patch risk summaries, can contain sensitive values, and that you should review them before sharing. So if you were leaning on the tool to scrub those logs, you need to do your own scrubbing now, before anything gets posted or archived.

Ethan Park

Second, if you run the findings service, clients must send a Content Type header of application slash json to POST slash v1 slash bulk slash findings and POST slash v1 slash dedupe dash groups. Sorry, I mean the dedupe groups endpoint, under v1. A missing or different content type returns HTTP 400, invalid_request. A charset parameter is accepted, so application slash json with a charset is fine. Any script that posts a bare body will break on upgrade.

Maya

Two more. SDK types and CLI schemas now accept any nonempty string for reasoning effort, not a fixed list. So if your integration validates against a hard coded set of values, update it. The value still has to be supported by Codex and your model provider, though. And if you export results as CSV, older exports may have ambiguous leading apostrophes that can't be recovered from the CSV alone. If you need those exact values, export the original saved results as JSON.

Ethan Park

Now the smaller quality of life changes. Scans now check for exposed credentials in source code, including unused code and tests, and they distinguish suspected exposures from placeholders. That check runs offline, and it doesn't try any discovered credential against a service. That's worth knowing if your security team has rules about that.

Maya

On the command side, the model and effort flags are now shared. You can use them when generating patches, validating findings, verifying fixes, or matching and comparing saved scans. Deep Scan workers and patches generated during a scan also respect your selected service tier. Patch, validation, and fix verification commands now respect custom model providers and their authentication settings. Amazon Bedrock users get clearer authentication errors and cost estimates for Daybreak Blue and Red. And eligible OpenAI API key users can select a Cyber access program for each scan.

Ethan Park

Coverage expanded too. Scans now pick up C++ headers ending in dot h h and dot h x x, server rendered templates in EJS, ERB, and PHTML, and Vyper source files. Files that used to be silently skipped may now produce findings, so expect your first scan after upgrading to look different.

Maya

And two behavior changes I like. On Unix, scans check that the sandbox works before starting paid model calls, so a broken sandbox gets caught early instead of mid run. And if you cancel follow up work, completed results are kept.

Ethan Park

One more item, outside Codex Security. Codex CLI 0.160.1 shipped on October 5. It preserves SYSTEMROOT, TEMP, and TMP when launching remote stdio MCP servers that have explicitly configured remote environment variables. That lets Unix hosts keep the Windows executor's startup environment. If you run a Unix host driving a Windows executor, install it with npm install dash g at openai slash codex at 0.160.1.

Maya

So the practical checklist is short. Upgrade, scan, export the threat model once to see which format you get, then fix any reader that assumes the old file name or skips the null check. Then audit where your CI logs go. That's it for today.