Diagnosing Codex, like any diagnosis, obeys one rule: change one variable per step and do not destroy the evidence. The basic triage is simple and worth doing before any radical actions. codex --version records the version, codex doctor checks the installation and environment, codex login status shows the sign-in state. These three commands answer the question "what is in play at all now", and you start with them rather than with wiping ~/.codex, which destroys both the configuration and the evidence at once.

For deeper diagnosis there is a log, but you enable it consciously. An opt-in plaintext TUI log for local diagnostics is enabled via RUST_LOG=debug with a log_dir specified. It helps to see this command once. But it has a direct security consequence: logs and session transcripts may contain prompts, file paths, command output and secrets. So an enabled debug log is treated as a sensitive artifact - it is not attached to a public issue without looking and not stored just anywhere.

The rule about log sensitivity matters more than it seems, and it is set out separately. A transcript or a debug log is not harmless technical output: secrets, private paths and command content may end up in it. Before sharing such an artifact for a report, it is checked and cleaned. For a bug a sanitized fragment is safer than a raw session dump. This is the same discipline as with secrets in the context: the sensitive must not leak through the diagnostics done to help.

Codex Security is a separate product workflow, not another name for the ordinary /review, and they must not be confused. It is meant for finding and confirming vulnerabilities - a specialized task with its own finding lifecycle, not a general code review. It is available both as a plugin/cloud experience and as a public CLI and TypeScript SDK @openai/codex-security. Expecting from the ordinary /review what Codex Security gives means underestimating a specialized tool, and from Codex Security that it is just "a stricter review".

It helps to see how a security scan is started once. Below are installing the package, checking the version and scanning the current directory with authentication through ChatGPT. A scan requires authorization - it is not an anonymous operation. And deep and bulk scans, CI integration, export, validation and the finding lifecycle have a separate official reference page. That is, a basic scan is simple, but a full security process is a separate area with its own documentation, checked rather than reproduced from memory.