OpenAI Codex Security 0.1.29 Gets Custom Policy Guardrails
We break down OpenAI’s codex security 0.1.29 release, including custom patch validation prompts, markdown-based severity classification rubrics, and a cleaner CLI workflow for triaging findings. The update also adds Terraform file coverage, streaming for large scan logs, and sortable tables in the findings dashboard.
Chapter 1
Custom Patch Validation Prompts and Severity Rubrics in Codex Security 0.1.29
Maya
Um, so, Ethan, you know how automated security scanners are, like, notorious for yelling at you about things that don't actually matter for your specific setup?
Ethan Park
Oh, absolutely. The classic critical severity page at three in the morning for a dev dependency that isn't even exposed to production.
Maya
Right! Exactly. Well, OpenAI just dropped version 0.1.29 of their open source codex security package. And, um, before we dive into the technical details, shoutout to Jellypod for supporting our daily show! But yeah, this release is basically all about giving teams actual control over how security findings and automated patches get evaluated.
Ethan Park
Control in what sense? Like, custom rules?
Maya
Yeah! So, pull request 940 introduced custom patch validation prompts. When codex security finds a vulnerability and tries to auto generate a fix, you can now pass in your own custom validation prompt. So instead of just letting the model guess if a patch is acceptable, you give it explicit constraints.
Ethan Park
Ah, I see. So if your team has a policy like, say, never introduce new external dependencies, or you must match a specific coding pattern, you can enforce that directly in the prompt before it even generates the pull request?
Maya
Exactly. You guide the validation step directly. And then on the triage side, they added custom severity classification rubrics.
Ethan Park
Wait, how does that work with existing scans? Do you have to re run the whole scan?
Maya
No! That is the cool part. You run npx at openai slash codex security classify severity, pass it your scan ID, and point it to a markdown rubric file, like slash path to policy dot md. It re assesses the finding severities against your internal org policies without altering the sealed scan artifacts or touching the raw findings.
Ethan Park
Hmm. That is pretty clean. From my product days, keeping the raw audit record sealed while overlaying business logic on top is... that's huge for compliance.
Maya
It completely eliminates triage noise. Back when I was doing software testing, getting a raw model finding mapped directly to an emergency page was a nightmare. Now, if a finding doesn't match your custom rubric's high threshold, it doesn't wake anyone up.
Chapter 2
Real Workflows, Operational Caveats, and QoL Upgrades
Ethan Park
So how does this actually look in a developer's day to day CLI workflow?
Maya
So, first you run npx at openai slash codex security scan dot to scan your current directory. Then when you run the patch generation command, you pass your custom patch validation prompt. And before exporting those findings to Linear or GitHub issues, you run that classify severity step with your markdown rubric.
Ethan Park
But wait, are there catch... are there caveats here? What happens if you don't supply a rubric?
Maya
If no rubric is supplied, it's completely opt in. It just falls back to the original scan severity without making any extra model calls, so you don't burn extra API budget. But for custom validation prompts, you have to be careful. If your prompt constraints are too contradictory or strict, the model might just refuse to generate a patch altogether.
Ethan Park
Makes sense. Give it an impossible task and it just throws its hands up. Were there any other quality of life updates in 0.1.29?
Maya
A bunch of practical ones! Pull request 944 automatically includes Terraform infrastructure files, dot tf files, in scan inventories now. And pull request 932 streams large saved scan JSON logs, so your memory doesn't spike when scanning massive repositories.
Ethan Park
Oh, and they added sortable tables to the findings dashboard preview in pull request 958, right?
Maya
Yes! Makes sorting through stored scan runs way easier.
Ethan Park
You know, looking at this whole release, it feels like we're moving past just trusting raw AI outputs for security. Giving teams policy driven validation prompts bridges that gap between automated patch creation and actual code review.
Maya
Yeah, exactly. It's about guardrails, not just automation. Well, that is 0.1.29 in a nutshell! Good chatting, Ethan.
Ethan Park
Talk soon.