Run a deep scan when you need a more thorough review and can allow for a longer runtime. Deep scans search a repository more extensively and can reduce variability between runs.
Start with a standard scan to check your scope and results. Then use a deep scan when you need a more thorough assessment.
Choose between standard and deep scans
| Standard scan | Deep scan | |
|---|---|---|
| Best for | First runs and routine repository or folder review | More thorough reviews after a standard scan |
| Variability | Standard | Reduced |
| Scope | Repository or explicit folder | Repository or explicit folder |
| Runtime and resources | Lower | Higher |
| Pull requests and diffs | Use the change-review workflow | Not supported; use the change-review workflow instead |
Start the deep scan
In the desktop app, open Security, select Scans, and select + Scan. Choose a repository or another folder, select Codebase, and turn on Deep scan. The scan covers the entire selected repository or folder.
You can also start a repository-wide deep scan from a Codex conversation:
Use $codex-security:deep-security-scan to run a deep security scan of this repository.For one component in a monorepo, identify the folder explicitly:
Use $codex-security:deep-security-scan to run a deep security scan of /absolute/path/to/repository/services/payments.For a scoped deep scan in the desktop app, select the folder as the codebase. The scan covers the entire selected folder.
Confirm setup and preflight
For the best scan quality, use gpt-5.6-sol
with xhigh reasoning effort.
- Select Codebase and turn on Deep scan.
- Confirm that the repository or selected folder is the code you intended to scan.
- Choose a model and reasoning effort.
- Open Additional context for concrete attack vectors, sensitive application areas, or repository context that the code can’t reveal.
- Select Start scan.
- Review any setup or capability warning before you approve a configuration change.
Deep scans require delegated workers. If the current runtime doesn’t meet the capability requirements, use a standard scan or try again when enough capacity is available.
Discovery workers inherit your selected model and reasoning settings. Follow the saved scan from Scans, or select View activity to inspect its Codex task. Check the plugin changelog before you update the plugin or start a long-running scan.
Track the active deep-scan phase and inspect its Codex activity before reviewing the completed result.
Review the result
Deep scans use the same saved scan details and complete scan directory as
standard scans. Open the completed scan in Scans or review its findings in
Findings. When available, report.md links to one detailed report for each
reportable finding and a structural hardening portfolio when findings remain.
Keep the linked findings/ and hardening/ directories with the report when
sharing or archiving the result.
Review the coverage summary before the findings. Even a deep scan has limits, so check deferred surfaces and remaining proof gaps before drawing a conclusion. For a finding you accept, continue with Fix and verify a finding.
To review a pull request, commit, branch range, or local patch, use Review code changes. A deep scan never substitutes for the diff-focused workflow.