How to use it
- Once at setup, work through sections A to H.
- Fix every P1 item before doing any work on company code. P2 items close important gaps; P3 items are good practice.
- Items with an audit check ID are verified automatically by the Codex Security Audit. Re-run it monthly and after every Codex upgrade. Items without one are confirmed by hand.
- Keep the completed checklist with your saved audit report as your assessment record.
A. Installation and identity
| # | Check | Priority | Audit check |
|---|---|---|---|
| A1 | The Codex CLI is 0.146.0 or later (the Plugin4Shell fix), and the desktop app and IDE extension are current. | P1 | I01 |
| A2 | Work code runs under a ChatGPT work sign-in; organisations pin it with forced_login_method and forced_chatgpt_workspace_id. | P1 | manual |
| A3 | Codex and MCP credentials are stored in the OS keyring (cli_auth_credentials_store and mcp_oauth_credentials_store set to "keyring"). | P2 | C07 |
| A4 | Advanced Account Security is on where eligible, with a backup key stored safely. | P3 | manual |
| A5 | No config, profile or script sets the retired approval_policy = "untrusted". | P1 | C03 |
B. Sandbox and approvals
| # | Check | Priority | Audit check |
|---|---|---|---|
| B1 | A permission profile that extends :workspace or :read-only is the default; full access is never the default. | P1 | C02 |
| B2 | approval_policy = "on-request"; never "never" on a machine with credentials. | P1 | C03 |
| B3 | --yolo and --dangerously-bypass-approvals-and-sandbox are used only in disposable containers, and no alias adds them. | P1 | S01 |
| B4 | Auto-review is not treated as a security boundary for sensitive work. | P2 | C09 |
| B5 | allow_login_shell = false, so commands don't load shell startup files and their secrets. | P3 | C08 |
| B6 | Native Windows uses the Windows sandbox in "elevated" mode. | P2 | manual |
C. Secrets and network
| # | Check | Priority | Audit check |
|---|---|---|---|
| C1 | The permission profile denies **/.env*, ~/.ssh, ~/.aws and other credential folders. | P1 | C06 |
| C2 | Command network access is off by default; when needed, network_proxy is on with an allow list and no wildcards, paste or webhook sites. | P1 | C04 |
| C3 | web_search is "cached" or "disabled", never "live" for routine work. | P2 | C05 |
| C4 | On native Windows, web_search = "disabled". | P1 | C05 |
| C5 | No secrets in MCP env blocks; env_vars or bearer_token_env_var pass them instead. | P2 | C14 |
| C6 | No production credentials in the environment Codex runs in. | P1 | manual |
D. Command rules and hooks
| # | Check | Priority | Audit check |
|---|---|---|---|
| D1 | ~/.codex/rules/default.rules asks before git push and forbids recursive deletes, tested with codex execpolicy check. | P2 | R01 |
| D2 | No allow rules for shells, rm, sudo, network or infrastructure tools; every rule states its decision. | P1 | R02 |
| D3 | Every hook and notify command was reviewed before trusting it, none downloads remote code, and --dangerously-bypass-hook-trust is never used. | P1 | C12, C13 |
E. Extensions: MCP servers, plugins and skills
| # | Check | Priority | Audit check |
|---|---|---|---|
| E1 | Every MCP server is approved, pinned to a version, and limited with enabled_tools. | P1 | M01, M03 |
| E2 | Servers that read content outsiders write (errors, tickets, chat, email) have read-only scopes and default_tools_approval_mode = "prompt". | P2 | M02 |
| E3 | skill_mcp_dependency_install = false, so skills can't install MCP servers on their own. | P2 | C10 |
| E4 | [memories] disable_on_external_context = true. | P3 | C11 |
F. Repositories
| # | Check | Priority | Audit check |
|---|---|---|---|
| F1 | Before trusting a project: .codex/config.toml, .codex/hooks.json, .codex/rules/ and AGENTS.md are reviewed. | P1 | P01, P02, P03, P05, P06, P07 |
| F2 | The project .env sets no CODEX_* variables. | P1 | P04 |
| F3 | Repositories that arrive with their own .git/config (archives, shared folders) are checked for core.hooksPath, core.fsmonitor and filter drivers. | P2 | P12 |
| F4 | Symlinks are listed and none points at .codex/, AGENTS.md or a dotfile. | P1 | P11 |
| F5 | Untrusted code is opened only in a container or Codex cloud. | P1 | manual |
| F6 | .env files are gitignored. | P2 | P10 |
G. Codex cloud and integrations
| # | Check | Priority | Audit check |
|---|---|---|---|
| G1 | Cloud environments keep agent internet access off, or limited to package managers or named domains; never "All (unrestricted)". | P1 | manual |
| G2 | Setup scripts are reviewed and environments hold only the secrets the task needs. | P2 | manual |
| G3 | The GitHub connection covers only the repositories Codex needs, and branch protection stops it merging. | P1 | manual |
| G4 | Code review and task triggers run only on repositories and channels without untrusted contributors. | P2 | manual |
| G5 | Connectors that bring in outside content (email, files, web) are enabled only where the task needs them. | P2 | manual |
H. Working habits and endpoint
| # | Check | Priority | Audit check |
|---|---|---|---|
| H1 | Instruction-like text in issues, pull requests, web pages and tool output is read by a person before Codex acts on it. | P1 | manual |
| H2 | One workspace per session, and git worktrees for parallel or background work. | P2 | manual |
| H3 | AGENTS.md states security rules: secrets from environment variables, no eval, ask before external calls. | P3 | P09 |
| H4 | Secret scanning, SAST and SCA run on every pull request, and a person reviews every AI-authored change. | P1 | manual |
| H5 | On Windows, C:\ProgramData\OpenAI\Codex exists and only administrators can write it. | P1 | W01 |
| H6 | Suspicious agent behaviour is reported to the security team the same day. | P2 | manual |
Sources
- OpenAI Codex documentation: Configuration reference, Agent approvals and security, Permission profiles, Rules, Hooks, Managed configuration.
- Repository and Windows risks behind sections F and H: see the Common Codex Misconfigurations.
Informational only, with no guarantee of a vulnerability-free setup, so test every configuration in your own environment. AISecurityLabs.org is independent and not affiliated with OpenAI. Setting names change as Codex evolves, so check them against the configuration reference for your version.