Turn a code fix into a review checklist
Using Codex CLI where available: Supply a public patch and authorized code to list related files, concerns and suggested tests.
Execution environment and usage
AI / software
Codex CLI (suggested exercise route; original stack differs)
Where to operate
Codex CLI in a terminal with an isolated authorized project copy. This suggested route is not the same installable system as the original research setup.
Getting started
- Follow the linked official Codex setup guide, sign in and start Codex in the test project folder.
- Open the authorized repository copy and supply the public patch and relevant files.
- Use the case prompt for a read-only review checklist; have maintainers validate tests separately in isolation.
Setup and plan requirements
Readable source and a public patch; full validation additionally needs build and test tools. Requires Codex access and compatible project tools/versions. Authorize only necessary files and commands, without production-service connections.
Prompt portability limits
Big Sleep is a research setup, not a Gemini-chat feature. A pasted-diff review can travel; repository-wide inspection needs file access.
Usage limitations
This review performed no installation, hands-on test or regional-availability check. Project Zero describes commit-message/diff input, repository inspection, Gemini 1.5 Pro and debugger tooling.
Environment sources
適用情境 / When to use
Use the checklist to focus a maintainer’s next review. It identifies questions, not confirmed defects. Whole-repository inspection and test execution require source access and an isolated development environment. Google Project Zero reports that Big Sleep found a memory-safety issue in a development version of SQLite, fixed before release.
步驟 / Steps
- Choose a repository you own or are explicitly authorized to review and a public patch.
- Request the patch’s purpose, related files and boundary conditions for review.
- Have maintainers validate hypotheses in isolation and follow the project’s remediation and disclosure process.
提示詞 / Prompt
Read [public patch] in [authorized repository copy]. Produce a defensive review checklist with locations, concerns and suggested tests. Do not contact external targets, build attack chains or publish unconfirmed findings.
留意事項 / Cautions
- Stay within authorization; do not scan third-party live systems.
- AI findings are hypotheses, not security certification.
來源限制 / Evidence limits
One documented research-team finding, not a consumer product or general detection rate. We have not reproduced it.
流程說明 / Workflow note
The steps and prompt below are our original suggested exercise, not a transcription of the source workflow.
原始工具組合 / Original tool stack
Big Sleep / Gemini 1.5 Pro
Source publication date: 2024-11-01
Source checked: 2026-10-19