Reproduce the exploit in a sandbox, make the smallest fix, retain a regression test, and run SAST, DAST, dependency, and secret scans. A security owner approves the change.
Objective
close a verified vulnerability.
Context
finding, exploit path, affected versions, threat model.
Decompose
reproduce in a sandbox, minimal fix, regression test, dependency or config correction, scan.
Criteria
exploit no longer works; intended users retain access; SAST/DAST/dependency checks pass.
Review
security owner approves.
Rollback
feature flag or known-safe previous release.
Output
severity, root cause, fixed diff, evidence, disclosure decision.
Handoff checklist
- Exploit no longer works
- Intended access still works
- Scanners are clean or triaged
- Disclosure and rollback recorded
Editorial recipe adapted from the project’s September 2026 research brief. Commands, authority and acceptance tests must be matched to your repository. No production execution is implied.