Documentation 2026-07-06 22:58 UTC to 2026-07-08 02:01 UTC

40 40 

41</WorkflowSteps>41</WorkflowSteps>

42 42 

43Repository-specific guidance in `AGENTS.md` can also establish the product43For persistent repository security guidance, add a `SECURITY.md` at the

44surfaces, trust boundaries, supported validation commands, and out-of-scope44repository root. Use it to describe the threat model, security invariants,

45areas. Prefer concrete repository context over a generic planning step before45reportable finding criteria, exclusions, and severity context. For

46the scan.46directory-specific guidance, add nested `SECURITY.md` files. When policies

47conflict, the file closest to the code takes precedence. Codex Security treats

48this content as policy context, not executable instructions.

49 

50Use `AGENTS.md` for supported build and validation commands and other

51repository-specific instructions.

47 52 

48## Let the phases complete53## Let the phases complete

49 54