Cannot disable Codex Security Review while keeping Code Review enabled

What issue are you seeing?

The docs describe Code Review and Security Review as independently
configurable per repository. In practice there is no configuration that
produces "Code Review on, Security Review off" — neither the repository-level
nor the personal-level setting offers a disabled state for Security Review.

At https://chatgpt.com/codex/settings/code-review, under Repository
preferences, "Auto security review" ("Choose which pull requests Codex
should automatically review for security in this repository") offers three
options:

• Review all PRs
• Review team PRs
• Follow personal preferences

None of them means "never".

Selecting "Follow personal preferences" defers to the panel titled "Personal
code review preferences" ("Control how Codex reviews your pull requests by
default"). The controls in that panel are:

• Auto review (toggle) — "All your pull requests in a Codex enabled
  repository will be automatically reviewed."
• Review trigger (dropdown) — On PR open / On every push / Smart Trigger
  (Experimental)
• Exhaustive code review
• Enable credits use

None of these is labeled for security review, so it is unclear what
"Follow personal preferences" resolves to for Security Review, and there is
no personal-level control that disables it.

Severity thresholds reduce what gets posted but do not stop reviews from
running, so they are a noise control rather than an opt-out.

The repository-level help text reads "When security review is turned on,
Codex automatically checks the pull request for security issues," which
describes a turned-off state the UI does not appear to expose.

What steps can reproduce the bug?

1. Connect a repository to Codex cloud with Code review enabled.
2. Go to https://chatgpt.com/codex/settings/code-review.
3. Attempt to disable Security Review for that repository at either the
   repository or personal level.
4. Observe that no option disables it.

What is the expected behavior?

A way to disable Security Review for a repository while leaving Code Review
enabled — either an "Off" / "Never" option in the repo-level Auto security
review dropdown, or a personal-level security review control for "Follow
personal preferences" to resolve to.

Additional information

Current workaround and why it is insufficient

The only reliable way to stop automatic Security Reviews is to remove the
repository from the Codex GitHub App installation (GitHub > Settings >
Applications > Installed GitHub Apps > Codex > Configure > repository
access). That also disables Code Review and Codex cloud tasks for the
repository, so there is no way to keep Code Review while dropping Security
Review.

Screenshots

1. Personal code review preferences, with the Review trigger dropdown open.
2. Repository-level Auto security review, with its dropdown open.

Related

• #26911 — Codex Code Review cannot be disabled and drains credits
• #13597 — Feature request: limit Codex auto code review to default branch

References

• https://developers.openai.com/codex/integrations/github
• https://learn.chatgpt.com/codex/security/security-review

Start at the Codex code-review settings page and inspect the repository-level Auto security review options alongside Personal code review preferences. Trace how “Follow personal preferences” is resolved, then verify the GitHub App configuration path as a comparison. Done means Security Review can be disabled for one repository while Code Review and other Codex features remain enabled.