Before your first session

Keep everything updated: the CLI, desktop app and IDE extension each had their own CVEs, and Codex has no setting that enforces a minimum version.
Sign in with ChatGPT for work: usage then falls under your workspace’s policies, and organisations can pin the sign-in method and workspace.
Consider Advanced Account Security: it requires passkeys or security keys and protects Codex as well as ChatGPT; keep a backup key, because support can’t recover enrolled accounts (OpenAI).
Remove approval_policy = "untrusted": it was retired in Codex 0.149.0 and an explicit setting can stop Codex from starting.
On Windows, use the native Windows sandbox in its elevated mode, disable web search, and have an administrator lock C:\ProgramData\OpenAI\Codex before rollout.

Security for Codex Development: Before your first session