Jobjakt — required Codex Security workflow (v2)

Prerequisite: Owner confirms the Codex Security plugin is installed and available in their Codex environment. This package has NOT run any scan or verified findings. Verify each skill resolves in the session in which Codex performs the audit.

Official invocation prompts

Use $codex-security:define-security-policy to review Jobjakt's repository threat model and propose a scoped SECURITY.md describing trust boundaries and reportable severity; show the diff for human review before writing it.
Use $codex-security:security-scan to scan this repository for security vulnerabilities. Review the entire verified source tree at the recorded SHA, keep the checkout unchanged, and capture complete sanitized scan artifacts including coverage/deferred areas.
Use $codex-security:deep-security-scan to run a deep security scan of this repository. Before starting, get approval for any new charges and set owner-approved bounded concurrency and runtime. Compare with the standard scan and preserve the report directory and partial-coverage warnings.
Use $codex-security:security-scan to scan only <verified-subfolder> in this repository for security vulnerabilities. Highlight <trust-boundary-and-threat> and note what was not assessed.
Use $codex-security:fix-finding to fix finding <finding-id> from <scan-report-path>. Verify the vulnerability with safe synthetic fixtures, propose a minimal patch, write a failing regression where feasible, preserve legitimate behavior, and record proof gaps.
Use $codex-security:verify-fix to verify finding <finding-id> against this patched checkout without changing source files. Report fixed/still_vulnerable/inconclusive with reproducible evidence.
Use $codex-security:security-diff-scan to review changes from <approved-base-revision> to HEAD for security regressions. Do not modify the checkout. Record exact revisions and coverage.
Use $codex-security:assess-patch-risk to assess risk of <approved-base-revision> to HEAD using exact source and regression evidence; do not merge or deploy.
Use $codex-security:propose-security-hardening to assess repeated authorization / document / AI boundary findings, compare options and tradeoffs, and make recommendations without changing the repository.

Only skills 2–7 represent mandatory calls where they apply under MASTER_PROMPT.md. Skill 3 additionally needs cost/runtime approval; if approval is not granted, the deep-scan gate stays BLOCKED. Scans are codebase reasoning/validation in the tool environment and are not authorization for production attacks. Skill names above are supported by official Codex Security documentation as of 2026-10-26; if current installation exposes a different tool interface, inspect the actual skill list before using it. For Attack Path Analysis check the currently exposed plugin name rather than inferring an alias.

Required scan checkpoints

When	Action	Evidence / gate
Phase 00	Session/branch/scope preflight, billing gates, policy	Confirm plugin and rules; no scan assumed
Phase 01	Source threat model and full standard scan	Baseline scan result, paths, SHA and findings
Phase 03	Full deep scan after baseline	Run status, worker limits, report/finding set, approval record
Phases 04–13	Focused scan of specific uncovered code and validate attackers' paths	Actual targeted scan ID where performed; scope gaps
Phase 14, EACH accepted finding	Fix finding, verify fix	Diff, red/green tests, verification verdict, residual gap
Phase 14, EACH batch	Diff scan	Exact base/head revisions and report
Phase 15	Full standard rescan and remediation-range diff scan	Comparison with baseline, unclosed issues, human GO/NO-GO
Phase 16	Proposed recurring diff scans	Operational owner, cadence and alert response

Evidence register and handling

Create docs/security-audit/CODEX_SECURITY_SCAN_REGISTER.md from templates/CODEX_SECURITY_SCAN_REGISTER_TEMPLATE.md. Each run must record observed outcome (not intended outcome), source SHA, scope, skill, scan ID/paths, deferred areas, finding IDs, and whether validation was reproduced. Maintain the original reports privately if they contain sensitive internal paths; only commit sanitized summaries after inspection. Record charge approvals without storing payment credentials.

Do not silently bypass

Plugin fails, cannot read repository, cannot write scan artifacts or requires another connection: mark BLOCKED, include exact error and preserve offline findings.
Pending pricing/usage consent: mark CHARGE APPROVAL PENDING, do not initiate paid work.
Full scan completes but omits service directories: record omitted paths and rescan approved scope; do not claim total coverage.
Tool indicates success but tests are missing: report UNCERTAIN/UNVERIFIED, not secure.
A vulnerability involves live customer data or production host: don't attempt live reproduction. Use synthetic clone or code-based check and escalate to the owner.

Source docs

Standard scan: https://learn.chatgpt.com/docs/security/plugin/scans
Deep scan: https://learn.chatgpt.com/docs/security/plugin/deep-scans
Diff scan: https://learn.chatgpt.com/docs/security/plugin/code-changes
Fix and verify: https://learn.chatgpt.com/docs/security/plugin/fix-findings
Changelog / skill availability: https://learn.chatgpt.com/docs/security/plugin/changelog
Policy & skills: https://learn.chatgpt.com/docs/security/plugin/

5.5 KiB Raw Blame History Unescape Escape