security-best-practices

TL;DR

A security skill from OpenAI's catalog of Codex skills. It first works out every language and framework the project uses, then reads the guides in its references folder that match, named by language, framework and stack, plus a general guide for the language; for a web app it checks both frontend and backend. With no matching guide it falls back on well-known practices and, in a report, says that concrete guidance wasn't available. From there it either writes secure-by-default code, quietly watches for major vulnerabilities while working on your code, or produces a full report: an executive summary, findings grouped by severity with numeric IDs, line numbers and a one-sentence impact for critical ones, saved to security_best_practices_report.md unless you choose another place. Fixes come one finding at a time, after you agree, each with a short comment on the practice behind it, a check for regressions, and your usual tests and commit flow, without bundling unrelated findings into one commit. It follows project documentation that overrides a practice rather than fighting you. It doesn't trigger for general code review. The openai/skills repository is marked deprecated; its README points to openai/plugins for current Codex skills.

Summarizes the skill at 49f948f.