原文核对：2026-10-13 · 中文正文 · 英文提示词与演示
场景定位
检查基于 Git 的变更，验证可能的安全回归，并在合并前生成有证据的报告。
- 难度
- 中级
- 时间跨度
- 30 分钟
适合用于
- 涉及认证、授权、解析、文件访问、密钥或特权流程的 PR。
- 合并前需要安全检查的发布分支或本地补丁。
- 需要将发现定位到变更及直接相关文件的审阅者。
相关工具
针对 PR、提交、分支差异或工作区补丁提供验证和攻击路径证据。
Codex Security:security Diff Scan ↗起步提示词
英文原文 · 可复制后按实际材料修改
Use $codex-security:security-diff-scan to review this PR, commit, branch diff, or working-tree patch for security regressions.
Scope and rules:
- Target: [this pull request / commit SHA / branch diff from BASE to HEAD / the current working-tree patch]
- I am authorized to assess this repository and change set.
- Pay particular attention to [auth, input handling, secrets, filesystem, network, dependencies, or other sensitive surface].
Return the final Markdown report and inline code comments for findings that require human review.聚焦变更
敏感路径发生变化时，用安全 diff 扫描。插件借助仓库背景理解变更，将发现和验证限定到差异及直接支持代码。
它补充普通代码审查，关注安全回归证据，而非通用风格或测试审查。
执行定向检查
- 打开仓库，检出或说明准确的 Git 变更集合。
- 完成插件快速入门，并在提示词中指定 PR、提交、分支差异或工作区补丁。
- 指出认证、解析器、路径、网络请求或凭据等高风险部分。
- 首轮只请求扫描，不要求修复，使结果保持审查产物。
- 决定修复前核对受影响行、验证结果和证明缺口。
跟进发现
报告应区分有证据且可达的发现与尚待确认的怀疑，可包含受影响行的行内评论。确认可行动后，以发现标识符或报告段落创建单独、受控的修复任务。
变更选择器、diff 范围和结果审阅参阅 Review code changes for security。
展开英文原文对照
Use the Codex Security plugin to examine a Git-backed change set, validate plausible security regressions, and produce an evidence-based report before merge.
Review the change instead of the whole repository
Use a security diff scan when a pull request, commit, branch, or local patch changes a sensitive code path. The Codex Security plugin uses repository context to understand the change, then keeps finding discovery and validation focused on the diff and directly supporting code.
This workflow complements ordinary code review. Use it when you want evidence about security regressions, not a general style or test review.
Run a focused pass
- Open the repository and check out or describe the exact Git-backed change set to review.
- Complete the Codex Security plugin quickstart and specify the pull request, commit, branch diff, or working-tree patch in the starter prompt.
- Name high-risk surfaces in the change, such as authentication, parsers, file paths, network requests, or credential handling.
- Run the prompt without requesting a fix so the first result remains a review artifact.
- Check each reported affected line, validation result, and stated proof gap before deciding whether to remediate.
Follow through on a finding
A useful report distinguishes a reachable, supported security finding from a suspicion that still needs confirmation and can include inline code comments for affected lines. For an actionable result, open a new bounded fix task with the finding identifier or the relevant report section. See Remediate a vulnerability backlog for the fix-and-validation loop.
For change selectors, diff scope, and result review, see Review code changes for security.