OpenAI updated Codex Security to import results from other security scanning tools. The structure for scan scope and review data also changed, requiring teams that read results automatically to update their integration code.

1. Bringing OpenGrep evidence into the review workflow

Version 0.8.0, released on October 28, 2026, supports importing OpenGrep reports. This brings issues and evidence found by existing tools into security review workflows.

Reports can be imported as JSON or in gzip-compressed form. The targets are workbench, a local workspace, and Cloud, a remote service. Reports can be loaded locally or published remotely.

Imports require the source repository URL and external imports to be enabled. The release lists the following publishing command, repository option, and enablement setting.

publish findings --provider opengrep
--source-repository-url
CODEX_SECURITY_ENABLE_EXTERNAL_IMPORTS=1

Imported findings retain evidence from the original scanner. However, they start out unevaluated, so a review process must follow the import.

2. New locations for scan scope and review records

The key result-structure change is reading scan scope and review data from new locations. Integration code is directed to look up scan targets and review progress separately.

Integrations reading SDK or JSON results must use review, rather than ScanResult.coverage or the same-named exported field, to find scope excluded from comparisons. Comparison logic using the old fields is a priority for updates.

Scan method and scope are read from manifest.scan. The manifest is a record collecting scan information and serves as the reference for checking scan targets.

Integrations that draft reviews now record reviewed areas, unfinished work, and open questions in reviewState. This changes not just where scan targets are stored but also where review progress is written.

3. Switching saved files and automation outputs together

New scans no longer write coverage.json. The replacement for the field that provided the result path is manifestPath. Integrations that locate saved files and pass them to subsequent processing also need changes.

Review data is read from scan.review in scan-manifest.json. Previously saved scans remain readable, so this transition focuses on files produced by new scans and the code consuming them.

Automation using GitHub Actions must rename the coverage-path output to manifest-path. For scans created with the current version, the old output is empty, leaving downstream jobs that read it without the required path.

Teams applying the update should check result-comparison logic, saved-file paths, and automation output connections together. Even when reading the same results, the changes needed depend on where code accesses them.

4. Improved scan resumption and access to saved artifacts

An interrupted Deep Scan can resume after additional instructions are cleared. The recovery path was fixed to allow clearing instructions used before the interruption and continuing the scan.

Saved artifacts from completed local scans remain readable after the original checkout is moved or removed. A checkout is the local source-code copy used for scanning, and completed results remain accessible if its location changes.

The release lists changes simplifying scan completion and recovery under compatibility changes. Documentation on recovering past scan records was also updated, addressing saved results as well as new scans.

5. The benefits of reusing results and the cost of integration updates

This version enables reuse of existing scanner evidence and continued work with results from interrupted scans or relocated source code. In return, existing automation must adapt result fields, file paths, and output names to the new structure.

Import processing now calculates remote request byte counts without converting each batch, a group processed together, back to the wire format. Result reprocessing also reduces unnecessary SQLite database reads and content parsing. These changes cut redundant work in calculating request sizes and reading saved results.

Codex Security 0.8.0 expands the use of external scanning evidence while requiring existing result integrations to migrate to the new structure.