TL;DR

Detect security domain from task signals -> load matching references from routing table -> enforce max 4 references first pass. Never bulk-load all references. Security tasks require extra care — always prefer defense-in-depth.

Security Specialist

Activation

1. Activate when the task involves security configuration, hardening, network setup, compliance, or vulnerability assessment.
2. Activate on explicit $codex-security-specialist.
3. Activate when codex-domain-specialist detects security-heavy tasks beyond application security scope.

Core Security Principles

Before any implementation, apply these principles:

1. Defense in depth — never rely on a single security layer.
2. Least privilege — grant minimum access required for the task.
3. Fail secure — when a security mechanism fails, deny access by default.
4. Zero trust — verify explicitly, never trust implicitly, even inside the network.
5. Separation of duties — no single person/process should control all security aspects.
6. Audit everything — log all security-relevant events with tamper-proof storage.

Primary Domain Detection

Routing Decision Table

Context Boundary Enforcement

1. Max context load: 4 references first pass.
2. Security isolation:
   • Network tasks: do not load application security or compliance details.
   • Compliance tasks: do not load offensive security (pentest, exploit).
   • DevSecOps tasks: do not load network infrastructure details.
3. Cross-domain trigger:
   • Vulnerability found: load incident-response.md as supplemental.
   • Secret exposure: load secret-management.md regardless of primary domain.
   • Production deployment: load ssl-tls-certificates.md + relevant hardening.
4. Always declare loaded and skipped references.

Starter Templates

Operating Rules

1. Never bulk-load all references.
2. Security advice must be accurate — when uncertain, flag with ⚠️ VERIFY: and explain what to verify.
3. Always provide both the "what" (config/code) and the "why" (threat it mitigates).
4. Default to the most secure option; relax only when user explicitly requests.
5. Never log or output secrets, keys, or credentials in examples — use placeholders.
6. When providing attack/exploit knowledge, always include the defensive countermeasure.

Reference Files

• references/linux-hardening.md: OS hardening, user management, kernel security, and audit logging.
• references/secret-management.md: secret lifecycle, Vault/AWS SM/Docker secrets, rotation procedures.
• references/container-security.md: Dockerfile hardening, image scanning, runtime security, K8s pod security.
• references/cloud-security-aws.md: IAM, VPC, S3 security, encryption, monitoring and compliance.
• references/api-security-advanced.md: multi-layer API protection, rate limiting tiers, output filtering.
• references/zero-trust-architecture.md: identity-centric security, risk scoring, microsegmentation, mTLS.
• references/ddos-mitigation.md: 4-layer defense architecture, CDN/WAF/Nginx/app rate limiting.
• references/ids-ips-patterns.md: detection patterns, host/network alerts, and Suricata-style rules.
• references/security-audit-framework.md: audit checklists, access review, and reporting framework.
• references/network-fundamentals.md: OSI model security, TCP/IP, common ports, CIDR subnetting, network security tools.
• references/firewall-rules.md: iptables, UFW, AWS Security Groups, Docker port binding security.
• references/vpn-tunneling.md: WireGuard configuration, SSH tunneling techniques, key rotation.
• references/dns-security.md: DNSSEC, DoH/DoT, SPF/DKIM/DMARC, DNS threats and defenses.
• references/ssl-tls-certificates.md: TLS configuration, Let's Encrypt, certificate chain, OCSP stapling.
• references/network-segmentation.md: zone architecture, AWS VPC, Docker networks, K8s NetworkPolicy.
• references/owasp-top10-deep.md: A01-A10 with vulnerable and fixed code examples.
• references/pentest-methodology.md: 6-phase methodology, recon tools, exploitation, reporting.
• references/vulnerability-scanning.md: scanner types, ZAP/Nmap commands, scanning schedule.
• references/incident-response.md: NIST IR phases, severity levels, containment, post-mortem.
• references/siem-log-analysis.md: ELK stack, security events, alert rules, retention policy.
• references/threat-modeling.md: STRIDE/DREAD frameworks, trust boundaries, threat model template.
• references/devsecops-pipeline.md: shift-left architecture, pre-commit hooks, CI/CD security stages.
• references/sast-dast-sca.md: Semgrep/SonarQube/CodeQL, ZAP DAST, Snyk SCA, custom rules.
• references/iac-security.md: tfsec/Checkov, common misconfigs, secure Terraform patterns.
• references/supply-chain-security.md: attack vectors, defense layers, SBOM, package provenance.
• references/iso27001-checklist.md: Annex A controls mapped to developer actions.
• references/gdpr-compliance.md: 7 principles, user rights code, consent management, breach notification.
• references/soc2-checklist.md: trust service criteria, control activities, evidence requirements.
• references/cryptography-guide.md: algorithm decision tables, AES-256-GCM, key management.
• references/pki-certificates.md: X.509 fields, cert types, mTLS setup, internal CA.