# Jobjakt full-stack adversarial security audit — Codex prompt pack

**Updated 26 October 2026 (Codex Security integrated edition, v2).** This is a set of *instructions and templates*, not a completed assessment, proof of safety or claim that scanners have been run. The listed architecture is historical context to verify against the live repository.

## Quick start
1. Finish functional development/tests. Handle known critical credential exposure/rotation immediately; do NOT wait until launch.
2. Open the repository in Codex; create or select a dedicated security review branch.
3. Review and fill `templates/RULES_OF_ENGAGEMENT.md`, especially exact staging targets, synthetic users, request caps, network boundaries and stop conditions.
4. Copy `MASTER_PROMPT.md` into a NEW Codex chat at the repo root. The master starts with a safe offline Phase 00.
5. Alternatively feed **one** file in `prompts/` per Codex phase to control cost and review every checkpoint.
6. Optional: copy `.agents/skills/jobjakt-security-auditor/SKILL.md` into your repository under the same path. Review its contents before installation; use `$jobjakt-security-auditor` after Codex discovers it. Check `resources/CODEX_SKILLS_AND_TOOLS.md` for available features and references.
7. Protect reports/logs from disclosing real user data or secrets. Keep raw sensitive artifacts out of Git and AI contexts.

## Important safety
- Code review can start immediately; active 'attacker' tests are for an **explicitly approved isolated staging environment** only.
- No prod host, customer CV, home LAN service, live OAuth/payment provider or real token is a permissible attack target merely because it is accessible.
- Codex Security is confirmed installed by the owner and its baseline/deep/diff/fix/verification workflows are required as described in `MASTER_PROMPT.md`. Do not bypass a blocked scan or authorize unexpected charges.
- A GO recommendation requires human review and scoped evidence, not a passing scanner alone.
- Other tools may require separate setup or payment. Codex Security installation is user-confirmed, but billing and permissions for each operation must still be checked.

## Included
- `MASTER_PROMPT.md` — master Codex orchestration prompt **with required Codex Security integration**.
- `prompts/00_...md` through `prompts/16_...md` — 17 detailed prompts, each pasteable by itself.
- `.agents/skills/jobjakt-security-auditor/SKILL.md` — optional reusable local Codex skill.
- `templates/` — rules of engagement, finding template, Codex Security policy-context template, scan register and security release gate template.
- `resources/CODEX_SKILLS_AND_TOOLS.md` — tools, skills, verified links and limitations.
- `resources/CODEX_SECURITY_WORKFLOW.md` — explicit plugin commands, scan gating and security evidence flow.

## Suggested order
Initial staging setup -> threat model -> secrets -> dependency/static scan -> identity -> tenancy -> API/integrations -> documents -> AI -> frontend -> DB/privacy -> host/network -> pipeline -> controlled adversarial staging run -> fixes -> independent retest -> monitoring/incident readiness.

**Security focus for Jobjakt:** cross-user CV and application isolation, OAuth/TOTP/token integrity, safe CV import+PDF export, Python/LLM boundary, MariaDB access, hosted Docker/Nginx, external integrations and CI supply chain.

## Version 2 execution note
Paste `MASTER_PROMPT.md` into a Codex conversation opened at the repository root. Codex Security is a **required audit mechanism**, subject to actual session access and cost authorization: baseline whole-repository standard scan, scoped deeper review, post-remediation diff scans, independent fix checks and final standard rescan. The local testing/staging parts remain bounded and require their own explicit approval. Use `templates/CODEX_SECURITY_SCAN_REGISTER_TEMPLATE.md` to record what really ran.