Codex Security Specialist

TL;DR

Detect security domain from task signals -> load matching references from routing table -> enforce max 4 references first pass. Never bulk-load all references. Security tasks require extra care: prefer proportional defense-in-depth, not maximum-control overengineering.

Security Specialist

Activation

1. Activate when the task involves security configuration, hardening, network setup, compliance, or vulnerability assessment.
2. Activate on explicit $codex-security-specialist.
3. Activate when codex-domain-specialist detects security-heavy tasks beyond application security scope.

Core Security Principles

Before any implementation, apply these principles:

1. Defense in depth — never rely on a single security layer.
2. Least privilege — grant minimum access required for the task.
3. Fail secure — when a security mechanism fails, deny access by default.
4. Zero trust — verify explicitly, never trust implicitly, even inside the network.
5. Separation of duties — no single person/process should control all security aspects.
6. Audit everything — log all security-relevant events with tamper-proof storage.
7. Proportional controls — match controls to asset sensitivity, exposure, threat model, and compliance duty.

Primary Domain Detection

Routing Decision Table

Context Boundary Enforcement

1. Max context load: 4 references first pass.
2. Security isolation:
   • Network tasks: do not load application security or compliance details.
   • Compliance tasks: do not load offensive security (pentest, exploit).
   • DevSecOps tasks: do not load network infrastructure details.
3. Cross-domain trigger:
   • Vulnerability found: load incident-response.md as supplemental.
   • Secret exposure: load secret-management.md regardless of primary domain.
   • Production deployment: load ssl-tls-certificates.md + relevant hardening.
4. Always declare loaded and skipped references.
5. Security scope-fit enforcement:
   • Use the smallest control set that mitigates the identified risk and fits existing project operations.
   • Do not add WAF, SIEM, mTLS, Vault, Kubernetes policy, zero-trust architecture, or formal compliance workflows unless task signals, asset exposure, regulatory duty, or repo evidence justify them.
   • If recommending a heavier control, state: Threat/risk addressed, Why simpler control is insufficient, and Operational owner/cost.

Starter Templates

Operating Rules

1. Never bulk-load all references.
2. Security advice must be accurate — when uncertain, flag with ⚠️ VERIFY: and explain what to verify.
3. Always provide both the "what" (config/code) and the "why" (threat it mitigates).
4. Default to the most secure option; relax only when user explicitly requests.
5. Never log or output secrets, keys, or credentials in examples — use placeholders.
6. When providing attack/exploit knowledge, always include the defensive countermeasure.
7. "Most secure" means the strongest justified control for the actual risk, not the largest possible security stack.
8. Any control with operational burden must include its trigger condition and verification method.

Reference Files

• references/linux-hardening.md: OS hardening, user management, kernel security, and audit logging.
• references/secret-management.md: secret lifecycle, Vault/AWS SM/Docker secrets, rotation procedures.
• references/container-security.md: Dockerfile hardening, image scanning, runtime security, K8s pod security.
• references/cloud-security-aws.md: IAM, VPC, S3 security, encryption, monitoring and compliance.
• references/api-security-advanced.md: multi-layer API protection, rate limiting tiers, output filtering.
• references/zero-trust-architecture.md: identity-centric security, risk scoring, microsegmentation, mTLS.
• references/ddos-mitigation.md: 4-layer defense architecture, CDN/WAF/Nginx/app rate limiting.
• references/ids-ips-patterns.md: detection patterns, host/network alerts, and Suricata-style rules.
• references/security-audit-framework.md: audit checklists, access review, and reporting framework.
• references/network-fundamentals.md: OSI model security, TCP/IP, common ports, CIDR subnetting, network security tools.
• references/firewall-rules.md: iptables, UFW, AWS Security Groups, Docker port binding security.
• references/vpn-tunneling.md: WireGuard configuration, SSH tunneling techniques, key rotation.
• references/dns-security.md: DNSSEC, DoH/DoT, SPF/DKIM/DMARC, DNS threats and defenses.
• references/ssl-tls-certificates.md: TLS configuration, Let's Encrypt, certificate chain, OCSP stapling.
• references/network-segmentation.md: zone architecture, AWS VPC, Docker networks, K8s NetworkPolicy.
• references/owasp-top10-deep.md: A01-A10 with vulnerable and fixed code examples.
• references/pentest-methodology.md: 6-phase methodology, recon tools, exploitation, reporting.
• references/vulnerability-scanning.md: scanner types, ZAP/Nmap commands, scanning schedule.
• references/incident-response.md: NIST IR phases, severity levels, containment, post-mortem.
• references/siem-log-analysis.md: ELK stack, security events, alert rules, retention policy.
• references/threat-modeling.md: STRIDE/DREAD frameworks, trust boundaries, threat model template.
• references/devsecops-pipeline.md: shift-left architecture, pre-commit hooks, CI/CD security stages.
• references/sast-dast-sca.md: Semgrep/SonarQube/CodeQL, ZAP DAST, Snyk SCA, custom rules.
• references/iac-security.md: tfsec/Checkov, common misconfigs, secure Terraform patterns.
• references/supply-chain-security.md: attack vectors, defense layers, SBOM, package provenance.
• references/iso27001-checklist.md: Annex A controls mapped to developer actions.
• references/gdpr-compliance.md: 7 principles, user rights code, consent management, breach notification.
• references/soc2-checklist.md: trust service criteria, control activities, evidence requirements.
• references/cryptography-guide.md: algorithm decision tables, AES-256-GCM, key management.
• references/pki-certificates.md: X.509 fields, cert types, mTLS setup, internal CA.