How to use Codex to review a SaaS pentest
Codex reviewed SaaS security and repaired findings in worktrees. Other agents checked reproductions before human merges; no audit acceptance was claimed.
uglyrobot.dev
Suggested prompt
Suggested prompt written by Agents In Use, not the source author. Replace bracketed inputs and review tool permissions first.
Review the scoped SaaS authentication, tenant, upload and webhook paths. Validate leads with non-destructive staging checks, implement each confirmed correction in a separate worktree and have a different verifier reproduce the issue and test the fix before my merge decision.
Reach people exploring AI agents
See placements →What happened
The author reports a security findings document and remediated issues checked by separate verifier agents. The source does not claim complete security or auditor acceptance.
Reported by Aaron Edwards — Personal blogHow the agent did it
- Codex reviewed source slices and validated leads against actual endpoint behavior.
- Implementation agents repaired findings in separate worktrees.
- Different verifier agents attempted reproduction and regression checks before Edwards merged fixes.
Where a person stepped in
Edwards scoped the work, kept endpoint probes non-destructive, separated implementers from verifiers and merged reviewed fixes.
Aaron Edwards used Codex to review DocsBot before its annual security assessment. The work began with source-level slices covering authentication, file handling, webhooks, billing, widgets, SSRF and tenant permissions, with a main agent evaluating the leads rather than treating every warning as a finding.
The review then checked staging and production endpoint behavior with non-destructive probes. Requests examined authentication, tenant boundaries, cookies and headers so that code-level suspicions could be compared with the application's actual responses. The author reports a substantial findings report mapped to compliance controls.
Remediation used separate worktrees. An implementation agent corrected an issue, while another verifier attempted reproduction and checked regression behavior. Edwards retained the merge decision. This separation was intended to prevent the agent that wrote a fix from being its only judge.
The concrete outcome is a reported security review and a set of verified corrections, not an accepted SOC 2 audit or proof that no vulnerabilities remained. Edwards explicitly describes the limits of replacing independent assessment. The useful account is its end-to-end workflow: scoped source review, restrained live checks, isolated fixes and a separate attempt to prove that each specific issue was gone.
Prompt
Suggested prompt (written by Agents In Use, not the author's)
Source: Personal blog · Aaron Edwards
Frequently asked questions
Were endpoint checks destructive?
The author describes non-destructive checks against staging and production behavior.
Why use separate verifiers?
The agent writing a correction should not be its only judge.
Did this establish SOC 2 compliance?
No auditor acceptance or complete security guarantee is reported.
More details
About this account
Codex reviewed source slices and validated leads against actual endpoint behavior. Implementation agents repaired findings in separate worktrees.
Original operator account opened. Findings and remediation totals are self-reported. The author explicitly does not treat this as proof of security or a substitute for an independent pentest; no SOC 2 auditor acceptance is claimed. Suggested prompt written by Agents In Use; no original task prompt was published in the verified account.
Credit: Aaron Edwards — Personal blog
Source published 25 Jun 2026
Source checked 14 Oct 2026
Tools and topics
Codex · Git worktrees · Staging endpoints · Regression tests
Security review · Independent verification
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.