原文核对：2026-10-13 · 中文正文 · 英文提示词与演示
场景定位
使用 Codex Security CLI 扫描一组仓库的指定提交，逐一审阅结果，决定需要调查或修复的问题。
- 难度
- 中级
- 时间跨度
- 长时间运行
适合用于
- 按指定提交评估一组服务的安全团队。
- 需要可重复的仓库清单及独立扫描结果的工程团队。
- 需要跨仓库确定发现和覆盖缺口优先级的审阅者。
开始之前
按照 CLI 快速入门安装 Codex Security 并完成身份验证。确认拥有安全扫描权限，以及对自有或获准评估仓库的 Git 访问权限。扫描使用本地权限运行，不会暂停请求批准；请阅读扫描权限说明。
准备仓库清单
先选择少量仓库。将以下内容保存为 repositories.csv，并替换示例 URL 和提交占位符：
id,repository,revision
payments,https://github.com/YOUR-ORG/payments.git,REPLACE_WITH_FULL_COMMIT_SHA
identity,https://github.com/YOUR-ORG/identity.git,REPLACE_WITH_FULL_COMMIT_SHA为每个仓库设置唯一 id 和完整提交 SHA。可以从本地检出目录获取 SHA：
git -C /path/to/repository rev-parse HEAD每次扫描审查该提交下的整个仓库。本流程不使用分支名、缩短的哈希或未提交改动。目录范围和仓库专属指令请参阅 CSV 选项。
GitHub 选项：也可以交互式地从 GitHub 账号或组织选择仓库，无需准备 CSV。
运行扫描
在 repositories.csv 所在目录中，将输出路径替换为被扫描仓库之外的私有目录，然后运行：
npx @openai/codex-security bulk-scan repositories.csv \
--output-dir /path/outside/repositories/security-scans \
--workers 2 \
--mode standard \
--max-attempts 1 \
--max-cost 5该命令同时运行两个标准扫描，每个仓库尝试一次。--max-cost 5 会在每次尝试的估算成本超过 5 美元时停止它；已经进行中的工作可能超出估算，因此这不是硬性上限，也不是整次运行共享的预算。开始前应确定这些参数。
CLI 将各仓库结果分别保存到 security-scans/artifacts/ 下的独立目录。结果可能包含源代码片段和漏洞细节，应保持私有。
审阅结果
打开结果目录，检查以下内容：
- 清单：在 manifest.json 中确认仓库和提交。
- 状态：阅读 results.jsonl，检查每次尝试的状态和产物位置。
- 覆盖与发现：在每次尝试的目录中先查看 coverage.json 中的缺口和排除项，再阅读 report.md 和 findings.json 中的发现及支持证据。
退出码 0 表示所有仓库均成功完成扫描，不代表没有漏洞。退出码 2 表示覆盖不完整、某个仓库无法完成，或存在输入及运行时错误。覆盖不完整时，发现列表为空也不能证明代码安全。
记录每个仓库的下一步：调查发现、修复已接受的发现，或跟进覆盖缺口。交接给负责团队时，附上扫描的提交和支持证据。
恢复中断的运行时，使用相同 CSV、指令和输出目录重复执行命令。CLI 会跳过已完成扫描，不会自动重试覆盖不完整的扫描。改变清单、版本、范围、模式或指令时，应使用新的输出目录。恢复细节见继续运行与重试说明。
展开英文原文对照
Use the Codex Security CLI to scan a list of repositories at specific commits, review each result, and decide what needs investigation or a fix.
Before you start
Complete the CLI quickstart to install and authenticate Codex Security. Confirm that you have security scan access and Git access to the repositories you own or have permission to assess. Scans use your local permissions and don’t pause for approval; review the scan permissions guidance.
Prepare the repository inventory
Start with a small set of repositories. Save this as repositories.csv, then replace the example URLs and commit placeholders:
id,repository,revision
payments,https://github.com/YOUR-ORG/payments.git,REPLACE_WITH_FULL_COMMIT_SHA
identity,https://github.com/YOUR-ORG/identity.git,REPLACE_WITH_FULL_COMMIT_SHAGive each repository a unique id and a full commit SHA. Get the SHA from a local checkout with:
git -C /path/to/repository rev-parse HEADEach scan reviews that commit, including the full repository. Branch names, shortened hashes, and uncommitted changes aren’t part of this workflow. For folder scopes or repository-specific instructions, see the CSV options.
GitHub option: You can choose repositories interactively from your GitHub account or organization instead of preparing a CSV.
Run the scans
From the directory containing repositories.csv, replace the output path with a private directory outside the scanned repositories, then run:
npx @openai/codex-security bulk-scan repositories.csv \
--output-dir /path/outside/repositories/security-scans \
--workers 2 \
--mode standard \
--max-attempts 1 \
--max-cost 5This runs two standard scans at a time, with one attempt per repository. --max-cost 5 stops each attempt when its estimated cost exceeds $5. Work already in progress can exceed the estimate, so this is not a hard cap or a shared budget for the whole run. Choose these values before starting.
The CLI saves each repository’s results in its own folder under security-scans/artifacts/. Keep the results private: they can contain source excerpts and vulnerability details.
Review the results
Open the results directory and check:
- Inventory: Confirm the repositories and commits in manifest.json.
- Status: Read results.jsonl for each attempt’s status and artifact location.
- Coverage and findings: In each attempt folder, read coverage.json for gaps and exclusions, then report.md and findings.json for findings and supporting evidence.
Exit code 0 means every repository completed successfully, not that no vulnerabilities exist. Exit code 2 indicates incomplete coverage, a repository that couldn’t complete, or an input or runtime error. An empty findings list with incomplete coverage does not establish that the code is secure.
Record the next action for each repository: investigate a finding, fix an accepted finding, or follow up on coverage gaps. Use the scanned commit and supporting evidence when handing work to the responsible team.
To resume an interrupted run, repeat the same command with the same CSV, instructions, and output directory. The CLI skips completed scans and does not automatically retry incomplete coverage. Use a new output directory when changing the inventory, revisions, scopes, modes, or instructions. See resume and retry guidance for recovery details.