[Aismit]

Summary

Standalone severity reclassification previously used either a supplied policy file or the policy bundled with the installed CLI. Picking up a new default meant upgrading the package or maintaining a local copy. This change lets users opt in to the current default for a reclassification.

Changes

• Set CODEX_SECURITY_ENABLE_REMOTE_SEVERITY_RUBRIC=1 to look up the default severity rubric in Statsig once for all findings and reviews in a standalone classification. With the variable unset or set to any other value, the bundled rubric is used.
• For example, run CODEX_SECURITY_ENABLE_REMOTE_SEVERITY_RUBRIC=1 codex-security classify-severity --scan latest --json. The three reviews per finding use the same fetched policy. Add --rubric ./policy.md and all three use the file with zero rubric lookups. SDK callers can pass rubricPath for the same behavior.
• The CLI help and classification guide describe the opt-in. It applies to reclassification of supplied or saved findings.

Testing

• Ran the standalone, saved-scan, CLI, and records classification suites together with seed 12345. All 124 tests passed.
• Exercised the built SDK with a synthetic finding, a test model, and the live config endpoint. The default made zero requests. Opt-in made one successful request for three reviews. Opt-in with a custom file made zero requests and passed the file contents to every review.
• Verified fallback with a failed HTTP response, an invalid policy, and a network error. Verified caller cancellation stops reclassification.
• SDK build, bundled plugin build, type checks, and formatting passed. Checked the built CLI's classify-severity --help.

Risk and rollout

The opt-in is off by default. The lookup sends the config name with exposure logging disabled. It uses a public client key and sends no findings or account identifiers. On timeout, service failure, or an invalid response, classification uses the bundled rubric. The existing result format and saved-assessment hashes stay compatible. The scope is standalone reclassification.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-11-02T19:36:47.143928Z	0ab1699	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.