Codex Security validation blocked on defensive review of personal repository

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.707.51957

What subscription do you have?

Plus

What platform is your computer?

Darwin 25.2.0 arm64 arm

What issue are you seeing?

I encountered what appears to be a false-positive cybersecurity block while using the Codex Security plugin on my own personal Python repository.

Prompt "@Codex Security] Do a security review of this repo."

The workflow had progressed to the validation stage of a security review when Codex stopped with:
“Goal blocked: This content can’t be shown. We take extra caution with cybersecurity requests.”

This was a defensive review of code I own, not an attempt to exploit an external system.
Feedback ID: 019f53da-dcea-7e60-b758-0e9d2d732e36
Product surface: Codex desktop / Codex Security plugin
Repository type: Personal knowledge-management Python application

This appears related to #32448 and #32468 , which reports the same cybersecurity block. My case differs because it occurred while using the Codex Security plugin during the validation stage of a defensive scan on a repository I own.

What steps can reproduce the bug?

• Open a personal Python repository in the Codex desktop app.
• Run the Codex Security plugin to perform a defensive security review.
• Continue through the workflow to the validation stage.

During validation, the workflow stops with:
Goal blocked and a popup that says "This content can't be shown
We take extra caution with cybersecurity requests. If you’re a security professional, you may be able to apply for Trusted Access."

The repository is a personal knowledge-management application that I own. The block occurred during the plugin-generated validation workflow, not from a manually entered exploit request.
Feedback ID: 019f53da-dcea-7e60-b758-0e9d2d732e36
Session ID: Not available
Token/context usage: Not available

What is the expected behavior?

The Codex Security plugin should complete the defensive validation of findings in a repository owned by the user without triggering a cybersecurity safety block. If a specific validation action cannot be completed, it should identify the blocked action and provide a clear explanation rather than stopping the entire workflow with a generic message.

Additional information

_No response_