›_ Codex Issues
Codex Issues / #38110

Cannot disable Codex Security Review while keeping Code Review enabled

Open 💬 3 comments Opened Aug 12, 2026 by samuelzamvil

What issue are you seeing?

The docs describe Code Review and Security Review as independently
configurable per repository. In practice there is no configuration that
produces "Code Review on, Security Review off" — neither the repository-level
nor the personal-level setting offers a disabled state for Security Review.

At https://chatgpt.com/codex/settings/code-review, under Repository
preferences, "Auto security review" ("Choose which pull requests Codex
should automatically review for security in this repository") offers three
options:

  • Review all PRs
  • Review team PRs
  • Follow personal preferences

None of them means "never".

Selecting "Follow personal preferences" defers to the panel titled "Personal
code review preferences" ("Control how Codex reviews your pull requests by
default"). The controls in that panel are:

  • Auto review (toggle) — "All your pull requests in a Codex enabled

repository will be automatically reviewed."

  • Review trigger (dropdown) — On PR open / On every push / Smart Trigger

(Experimental)

  • Exhaustive code review
  • Enable credits use

None of these is labeled for security review, so it is unclear what
"Follow personal preferences" resolves to for Security Review, and there is
no personal-level control that disables it.

Severity thresholds reduce what gets posted but do not stop reviews from
running, so they are a noise control rather than an opt-out.

The repository-level help text reads "When security review is turned on,
Codex automatically checks the pull request for security issues," which
describes a turned-off state the UI does not appear to expose.

What steps can reproduce the bug?

  1. Connect a repository to Codex cloud with Code review enabled.
  2. Go to https://chatgpt.com/codex/settings/code-review.
  3. Attempt to disable Security Review for that repository at either the

repository or personal level.

  1. Observe that no option disables it.

What is the expected behavior?

A way to disable Security Review for a repository while leaving Code Review
enabled — either an "Off" / "Never" option in the repo-level Auto security
review dropdown, or a personal-level security review control for "Follow
personal preferences" to resolve to.

Additional information

Current workaround and why it is insufficient

The only reliable way to stop automatic Security Reviews is to remove the
repository from the Codex GitHub App installation (GitHub > Settings >
Applications > Installed GitHub Apps > Codex > Configure > repository
access). That also disables Code Review and Codex cloud tasks for the
repository, so there is no way to keep Code Review while dropping Security
Review.

Screenshots
  1. Personal code review preferences, with the Review trigger dropdown open.
  2. Repository-level Auto security review, with its dropdown open.
Related
  • #26911 — Codex Code Review cannot be disabled and drains credits
  • #13597 — Feature request: limit Codex auto code review to default branch
References

View original on GitHub ↗

3 Comments

samuelzamvil · 16 days ago

<img width="1202" height="366" alt="Image" src="https://github.com/user-attachments/assets/f48ffe1d-d6ca-4d3a-b743-ba2bdc41d33c" />
<img width="1250" height="631" alt="Image" src="https://github.com/user-attachments/assets/16dfa1d6-4a47-4e94-982e-2567f8c81ff2" />

bingbingma · 5 days ago

The fact that you can't just turn off a feature once you've opted-in is absolutely criminal.

I innocuously see the prompt to turn on additional security review, "Codex: would you like to try it?"... sure... YES

Then "you've reached your security review limit" 50x a week, and i just want to turn it off but i can't because it can only "follow personal preferences" what absolute horse shit UX is this?

Ghostbird · 22 hours ago

Yes, this is extremely annoying! I didn't want automatic security reviews on every branch, so in a way I get what I wanted, because I'm not getting security reviews. I'm only getting "you've reached your security review limit" for every PR. It's obnoxious. Note that I DO NOT have automatic PR reviews enabled AT ALL!

Also, where is this UI posted by @samuelzamvil?

<img width="1202" height="366" alt="Image" src="https://github.com/user-attachments/assets/126e4d95-3602-4345-8185-9ba18149d194" />

I don't have that at all. But it might be that it's just unfindable, the UX of OpenAI is slightly above Microsoft Azure Portal – and I'm pretty sure that is the actual lowest possible UX in the universe.