原文核对：2026-10-13 · 中文正文 · 英文提示词与演示
场景定位
导入获准的工单或漏洞报告，用 Codex Security 逐项验证和修复，保留受控补丁与回归证据。
- 难度
- 高级
- 时间跨度
- 1 小时
适合用于
- 处理 Codex Security、Linear/Jira、GitHub 安全公告、HackerOne/Bugcrowd、渗透测试或内部审查结果的团队。
- 每个补丁都要求最小差异和可重复验证的漏洞积压。
- 希望把安全修复与大范围重构分开的维护者。
相关工具
用针对性测试或复现证据修复并验证一个已确认或合理的安全发现。
Codex Security:fix Finding ↗起步提示词
英文原文 · 可复制后按实际材料修改
Use $codex-security:fix-finding to fix this security finding and verify the issue no longer reproduces.
Source: [Codex Security report / Linear or Jira ticket / GitHub Security Advisory / HackerOne or Bugcrowd report / other authorized source]
Title and affected component: [finding title and component]
Vulnerable source, sink, or broken control: [known path or unknown]
Attacker-controlled input and impact: [input, prerequisites, and impact]
Expected security invariant: [behavior the fix must enforce]
Existing proof: [report path, PoC, reproducer, test, or validation notes]
Affected files and lines: [paths and lines, or unknown]
Constraints: [supported behavior to preserve, test command, rollout requirement, or none]
Requirements:
- Confirm that the issue still exists before changing code when feasible.
- Make the smallest change that enforces the intended security invariant.
- Add focused regression coverage or the strongest repeatable validation artifact available.
- Verify legitimate behavior still works and the original issue no longer reproduces.
- Keep unrelated backlog findings and refactors out of this change.
Report the changed files, tests or validation artifacts, exact commands and results, proof that the original issue no longer reproduces, and remaining uncertainty. If the issue is already fixed, show the evidence and do not change code.逐项处理已审阅发现
发现已有足够证据支持受控修复后使用。来源可为安全插件、Linear/Jira、GitHub 安全公告、HackerOne/Bugcrowd、内部审查或其他授权来源；尽可能连接来源或提供报告、工单、受影响代码和证据。
不要要求同时修改整个积压。单项循环更便于审阅安全不变量、补丁和验证证据。
用证据关闭一项
- 从团队授权来源选择一个发现。
- 提供来源引用、问题源头或失效控制、攻击者可控输入、受影响文件、复现证据和预期安全行为。
- 让 $codex-security:fix-finding 先复现或验证，再做最小补丁；已经修好则报告无需改代码。
- 连同补丁审阅回归测试或验证产物。
- 确认合法行为仍受支持，原漏洞路径不再复现。
- 选择下一项前记录剩余不确定性。
保持可审计
每项保留原始引用、精确代码变化、执行检查和证明缺口。已修复或无法复现时记录证据，不强行制造改动。
发现工作区和提示词修复路径参阅 Fix and verify security findings。
展开英文原文对照
Bring in approved findings from ticketing tools or vulnerability reporting systems, then use the Codex Security plugin to validate and address them one at a time with bounded patches and regression evidence.
Fix reviewed findings one at a time
Use this workflow after a security finding has enough evidence for a bounded remediation decision. The finding can come from the Codex Security plugin, an issue tracker such as Linear or Jira, GitHub Security Advisories, a disclosure platform such as HackerOne or Bugcrowd, an internal review, or another authorized source. Connect the source where supported, or provide the report, ticket, or advisory with affected code and evidence whenever possible.
Don’t hand Codex a broad backlog and ask it to change everything at once. A single-finding loop keeps the security invariant, patch, and validation evidence reviewable.
Close one item with evidence
- Select a finding from Codex Security, a ticketing system, a security advisory, a disclosure platform, or another source your team authorizes for remediation.
- Provide or retrieve its source reference, source or broken control, attacker-controlled input, affected files, reproduction evidence, and intended secure behavior.
- Ask $codex-security:fix-finding to reproduce or validate the issue before making a minimal patch, or to report that no code change is needed if it is already fixed.
- Review the regression test or validation artifact alongside the patch.
- Confirm that legitimate behavior remains supported and that the original vulnerable path no longer reproduces.
- Record remaining uncertainty before selecting the next item.
Keep the backlog auditable
For each completed item, keep the original ticket, advisory, or report reference; the exact code change; the checks run; and any proof gap. If Codex finds that the issue is already fixed or it can’t reproduce it, record that evidence instead of forcing an unnecessary code change.
For the findings workspace and prompt-driven remediation paths, see Fix and verify security findings.