Security Finding Discovery

Identify technically plausible security vulnerabilities in the authorized source, using the threat model and applicable security policy. Discovery preserves evidence for later validation; it does not decide final severity.

Read ../../references/artifact-storage.md before saving output and ../../references/security-guidance.md before source review. Resolve applicable policy for each reviewed path, including delegated assignments. Honor explicit input and output paths; ask for an explicitly required input only when its absence prevents the requested analysis.

Select the Workflow

Standard and Deep workers use their coordinator's self-contained prompts rather than this phase skill.

• Running compact diff: read the supplied inventory through list_codex_security_review_items, review every assigned changed file, and record all candidates once with record_codex_security_discovery_candidates. Do not create ranked worklists, per-finding ledgers, receipts, or discovery reports.
• Standalone diff without a compact inventory: use ../security-scan/references/scan-artifacts-and-ledger.md for the changed-file worklist and retained phase artifacts.
• Standalone repository discovery: apply the evidence criteria below to the authorized source and return the candidates and coverage limitations. Do not start a scan or run the diff worklist pipeline.

For a diff, inspect the actual changed behavior, including deleted files at the baseline revision. Follow supporting code far enough to understand the affected boundary; expand to sibling callers when a changed shared control affects them. Do not broaden into an unrelated repository audit.

Evidence Criteria