Using Codex and Codacy Security PR Review to Catch Vulnerabilities Before Production

This walkthrough demonstrates how to use Codacy Security PR Review and OpenAI Codex to identify and address security risks in pull requests before code reaches production. It covers GitHub setup checks, manual review requests, remediation through Codex, verification, and configuration of automated Codex PR reviews. The session is presented from the perspective of OpenAI's cyber deployment engineering team.

■ GitHub and Codacy connector setup
- Checking GitHub Apps installation and access for the Codacy connector
- Contacting workspace administrators or repository owners when access is unavailable

■ Manual security review workflow
- Requesting a Codacy security review through a pull request comment
- Reviewing the scan summary and interacting with findings in the pull request
- Using Codex to analyze the PR and publish a proposed fix
- Re-running a security review to verify the change

■ Automated Codex PR review configuration
- Navigating to Codex settings and the Code Review section
- Comparing personal and repository-level security review preferences
- Setting review triggers and severity thresholds for manual and automated reviews
- Referencing agent markdown and security markdown files for repository-specific guidance

■ Automated scan demonstration
- Opening a new pull request from a branch with known vulnerabilities
- Observing the automatic Codex security review pop-up and displayed findings

This is intended for developers, security engineers, and platform teams using GitHub-based workflows who want to understand how pull request security reviews can be configured and validated. Viewers can expect to learn the difference between manual and automated review flows and how Codex and Codacy are used together in a repository.