Updated 26 October 2026 (Codex Security integrated edition, v2). This is a set of instructions and templates, not a completed assessment, proof of safety or claim that scanners have been run. The listed architecture is historical context to verify against the live repository.

Quick start

Finish functional development/tests. Handle known critical credential exposure/rotation immediately; do NOT wait until launch.
Open the repository in Codex; create or select a dedicated security review branch.
Review and fill templates/RULES_OF_ENGAGEMENT.md, especially exact staging targets, synthetic users, request caps, network boundaries and stop conditions.
Copy MASTER_PROMPT.md into a NEW Codex chat at the repo root. The master starts with a safe offline Phase 00.
Alternatively feed one file in prompts/ per Codex phase to control cost and review every checkpoint.
Optional: copy .agents/skills/jobjakt-security-auditor/SKILL.md into your repository under the same path. Review its contents before installation; use $jobjakt-security-auditor after Codex discovers it. Check resources/CODEX_SKILLS_AND_TOOLS.md for available features and references.
Protect reports/logs from disclosing real user data or secrets. Keep raw sensitive artifacts out of Git and AI contexts.

Important safety

Code review can start immediately; active 'attacker' tests are for an explicitly approved isolated staging environment only.
No prod host, customer CV, home LAN service, live OAuth/payment provider or real token is a permissible attack target merely because it is accessible.
Codex Security is confirmed installed by the owner and its baseline/deep/diff/fix/verification workflows are required as described in MASTER_PROMPT.md. Do not bypass a blocked scan or authorize unexpected charges.
A GO recommendation requires human review and scoped evidence, not a passing scanner alone.
Other tools may require separate setup or payment. Codex Security installation is user-confirmed, but billing and permissions for each operation must still be checked.

Included

MASTER_PROMPT.md — master Codex orchestration prompt with required Codex Security integration.
prompts/00_...md through prompts/16_...md — 17 detailed prompts, each pasteable by itself.
.agents/skills/jobjakt-security-auditor/SKILL.md — optional reusable local Codex skill.
templates/ — rules of engagement, finding template, Codex Security policy-context template, scan register and security release gate template.
resources/CODEX_SKILLS_AND_TOOLS.md — tools, skills, verified links and limitations.
resources/CODEX_SECURITY_WORKFLOW.md — explicit plugin commands, scan gating and security evidence flow.

Suggested order

Initial staging setup -> threat model -> secrets -> dependency/static scan -> identity -> tenancy -> API/integrations -> documents -> AI -> frontend -> DB/privacy -> host/network -> pipeline -> controlled adversarial staging run -> fixes -> independent retest -> monitoring/incident readiness.

Security focus for Jobjakt: cross-user CV and application isolation, OAuth/TOTP/token integrity, safe CV import+PDF export, Python/LLM boundary, MariaDB access, hosted Docker/Nginx, external integrations and CI supply chain.

Version 2 execution note

Paste MASTER_PROMPT.md into a Codex conversation opened at the repository root. Codex Security is a required audit mechanism, subject to actual session access and cost authorization: baseline whole-repository standard scan, scoped deeper review, post-remediation diff scans, independent fix checks and final standard rescan. The local testing/staging parts remain bounded and require their own explicit approval. Use templates/CODEX_SECURITY_SCAN_REGISTER_TEMPLATE.md to record what really ran.