An evidence-first application security skill for Codex: find real attack paths, make narrow fixes, and verify them with regression tests.
Trust the Diff helps product teams turn security review into normal engineering work. It inventories a codebase, builds a threat model, traces untrusted input to sensitive operations, validates likely findings safely, and implements the smallest durable remediation when asked.
It is designed for SaaS products, APIs, dashboards, payments, webhooks, multi-tenant systems, file pipelines, cloud integrations, and AI-enabled applications.
Security findings should be tied to a concrete data flow, source location, security boundary, and verification path. A long checklist without evidence is noise. A patch without a regression test is a future incident waiting to happen.
- Authentication, sessions, OAuth/OIDC, MFA, password recovery, rate limits
- Authorization, BOLA/IDOR, RBAC/ABAC, tenant isolation, mass assignment
- Injection: SQL/NoSQL, command, template, path traversal, deserialization
- Webhooks, payments, idempotency, replay defense, race conditions
- SSRF, URL fetchers, file uploads, egress, cloud metadata access
- Secrets, logging, CI/CD, dependencies, lockfiles, IaC, third-party integrations
- Browser security: CSRF, CORS, cookies, XSS, security headers
- AI application surfaces: prompt injection, tool permissions, RAG data boundaries, output handling
git clone https://github.com/Rag-hubk/diffguard-codex-skill.git \
~/.codex/skills/trust-the-diff-appsec-codexRestart Codex or start a new task after installation.
Use Trust the Diff to review this repository for application security issues.
Build a threat model first. Report only evidence-backed findings with source
locations, attack paths, severity, and safe validation steps. Do not modify code.
Audit the payment webhook and entitlement flow. Check signature validation,
replay protection, idempotency, authorization, and concurrent requests.
Implement only confirmed fixes with regression tests.
Review this pull request for security regressions. Focus on changed trust
boundaries, authentication, authorization, untrusted input, secrets, and
external requests. Do not report hypothetical style concerns.
| Mode | Purpose |
|---|---|
audit |
Threat model and source-backed findings. Default. |
review |
Security regression review for a diff, branch, or pull request. |
verify |
Safely confirm a supplied finding or remediation. |
fix |
Apply a minimal confirmed remediation and regression test. |
hardening |
Propose architecture-level improvements without changing code. |
- Map entry points, assets, identities, trust boundaries, and security invariants.
- Trace user-controlled input and privileged actions through code and configuration.
- Classify candidates using the AppSec taxonomy.
- Validate exploitability safely in local, test, or explicitly authorized environments.
- Report findings with evidence, impact, prerequisites, and a targeted remediation.
- In
fixmode, add a regression test, patch the root cause, and verify relevant checks.
See the operating model, report format, and the skill instructions.
.
├── SKILL.md
├── references/
│ ├── appsec-taxonomy.md
│ └── validation-playbook.md
├── scripts/
│ └── inventory-attack-surface.sh
├── docs/
│ ├── OPERATING-MODEL.md
│ └── REPORT-FORMAT.md
└── .github/
- Do not attack production, use real credentials, exfiltrate data, or bypass authorization.
- Keep proof-of-concepts minimal, local, and non-destructive.
- Mark unverified hypotheses as
Needs validation; do not present them as vulnerabilities. - Never print, commit, or reproduce secrets in reports, tests, or issue trackers.
Built and maintained by Lynto Labs, a product development studio for SaaS platforms, AI integrations, Telegram-first products, and operational software.
Read CONTRIBUTING.md. Contributions should include a reproducible, safe scenario and must not contain exploit code that can target real systems.
MIT. See LICENSE.