feat(cli): draft SECURITY.md for owner review

[mldangelo-oai]

Summary

Add codex-security policy to draft a repository's SECURITY.md from its source code. It describes how the system works, builds a detailed threat model, and saves a shorter policy for its owner to review. It does not change repository files.

This builds on #510, which shares the command helpers. This PR adds drafting and preview; #489 adds saved-draft review and application. #485 and #505 are already in main.

Changes

npx @openai/codex-security policy .
npx @openai/codex-security policy . --path services/api
npx @openai/codex-security policy . --headless --output-dir /path/outside/repository/policy --json

• Read the source in three steps: describe the system, build its threat model, and draft the policy. Save the results in a private directory outside the checkout.
• Ask about important facts the code cannot establish, preserve unanswered questions, and show the exact proposed diff.
• Check existing policy files before starting Codex. Reject links that escape the checkout and hard-linked policy inputs that could read another file. Keep generated files and runtime state outside the checkout and its Git metadata. Do not load instructions from another checkout around the output directory.
• Use the same authentication and model settings as scans. Accept architecture documents and a total cost limit. Support dry runs and Markdown or structured output.
• Expose generation and preview through the SDK. Terminal previews display control characters safely, use the client's Python setting, and check for concurrent edits. Save the information feat(cli): review and apply saved SECURITY.md drafts #489 needs to apply the draft.

Testing

• pnpm run types and pnpm run format: passed.
• Full Bun suite in normal order and with randomized seed 12345: 1,410 passed, 11 skipped, 0 failed in each run.
• pnpm pack and the package checker: passed. Checked the installed SDK and CLI, bundled plugin and Codex executable, and a nested worker without a global Codex installation.
• Three fresh native Codex reviews and an independent verifier: no actionable findings.

Risk and rollout

Merge #510 first. This adds no npm dependencies and does not change saved scan results. The model has read-only file access, with network access, web search, apps, and MCP servers disabled. Preview checks the selected policy and its parent policies; regenerate after other relevant source changes. Generated decisions still need owner approval. Keep the detailed threat model and other draft files private until they have been reviewed for disclosure. This does not publish a package.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

An automated review contains a report link that is visible only to its requester. That link and report are not reproduced here.

[mldangelo-oai]

@codex review

Please review the current head, 8c6eaccccc63c3bef68af8ed65e1ac390e51d2c1.

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 8c6eaccccc

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review

Please review the current head, 8c6eaccccc63c3bef68af8ed65e1ac390e51d2c1. The description now records the requester-only automated report link; the code is unchanged.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 8c6eaccccc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: 8c6eaccccc

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

Security: Restrict policy reads to the selected repository

When an operator runs the new policy command on a malicious checkout, this profile gives Codex read access to the entire host filesystem. Repository-controlled policy text can reference an apparently relevant source file that is a symlink to /proc/self/environ, $HOME/.ssh/id_rsa, or another host file; opening it during the requested architecture inspection sends its contents into the inference turn. approvalPolicy: "never" and disabled tool networking do not block reads already allowed by the profile. Grant read access only to canonical repository/plugin/knowledge-base paths, and reject source symlinks resolving outside those roots.

Useful? React with 👍 / 👎.