[consumer451]

I have a side project that I always run a simple security analysis prompt on in CC, at each model release. Obviously, Fable 5 would downgrade to Opus 4.8 on any such request.

Nothing since Opus 4.6 has found anything interesting. Just ran it using Opus 5, and it found a genuine issue that I verified. Neato!

[roboyoshi]

Do you have a skill for that or do you (or anyone else here) just prompt with "try to find security issues"?

[consumer451]

I have a project-specific prompt saved as a text file. It is very basic, just focusing on the app's most important security issues. I kept it broad, so as not to over-specify.

Something along the lines of: "Please run a full security analysis on the entire project. Make sure user documents are secure."

Just something like that prompt found a vector in my web app's MCP server that I never would have considered. It was very much an edge case, but it did exist.

Being broad allows the model and harness to do the work. Giving too many instructions can apparently work against you in many cases.

Of course, when dealing with new PRs, I use the /security-review and /code-review skills.