Define a Security Policy

A useful SECURITY.md tells Codex Security what matters in a repository: the system boundary, threat model, security properties that must hold, what counts as a finding, and what is out of scope. It is policy context, not executable instructions.

1. Find the Applicable Policies

Resolve the repository or component from the user's request. Ask if the target is ambiguous. Inventory policy paths, including hidden directories, before reading them:

<plugin_dir>/scripts/launch_codex_security_mcp --helper resolve-security-md --repo <repo_root> --list

On Windows, use launch_codex_security_mcp.cmd with the same arguments. The resolver reads regular UTF-8 policy files, including symbolic links whose targets remain within the repository. Report rejected policies and the resulting coverage gap rather than bypassing those protections.

Read ../../references/security-guidance.md, then resolve the policy chain for the file or directory being reviewed:

<plugin_dir>/scripts/launch_codex_security_mcp --helper resolve-security-md --repo <repo_root> --scope <file_or_directory> --out -