Publish external findings

Before acquiring or importing findings, check for CODEX_SECURITY_ENABLE_EXTERNAL_IMPORTS=1 in the command environment. If it is unset or has another value, stop and ask the user to enable imports.

Use codex-security import sonar for live SonarQube Cloud issues or a capture saved by that command. Use codex-security publish findings for native scanner exports, including Sonar /api/issues/search pages with --provider sonar. Select the requested destination. The CLI owns source mapping, persistence, and Cloud authentication and retries. Do not implement another store or uploader or put credentials in command arguments.

Select the evidence

Use a supplied report, connected tool or signed-in CLI that provides the requested native records for the selected account, repository and ref. Follow the scanner import guide to narrow broader reports and verify the selection in the JSON preview. Use a direct API only when the provider guide supports its response for the selected destination. Otherwise ask for a supported report. A fresh scan produces new findings. Keep the original records and complete the requested pagination. A JSON summary or a different product's API response is not interchangeable with the documented report. Use SARIF or CSV only when the installed provider reader supports that profile and native JSON is unavailable or the user supplies that format. Do not convert a richer JSON report to SARIF for import.

Use the same acquisition format for repeated imports. Check the provider's identity rules before switching formats: another format can create a separate record or replace a richer snapshot with less detail. Importing findings does not reconcile equivalent vulnerabilities across formats. --format json controls command output, not the input report format; readers detect their supported inputs.

Import locally

Use a local repository path with --repository. No Cloud login is required.