Ask for a security-focused review on a risky change
Before merging a change to login, payments or file uploads, request a dedicated security review on the pull request and get findings to fix.
Steps
- Enable security review for the repository
- Comment @codex security review on the PR
- Fix or document each finding before merging
Starter prompt
@codex security review: this PR changes how uploaded invoices are stored. Check for path traversal, missing access checks and secrets in logs.
Guardrail: Treat findings as leads, then confirm them.
Prompts are our own examples. Results from sources are as reported by their authors.