Fix one penetration-test finding
One finding from the report, fixed against its written reproduction, with a test so it cannot come back.
The ticket
Fix a single finding from the report so its documented reproduction stops working.
Acceptance criteria
- The reproduction steps no longer produce the result
- A test encodes the reproduction so it cannot return
- The fix addresses the cause named in the report, not only the path used to demonstrate it
- The finding reference appears in the pull request
What lands as proof
A test built from the reproduction steps, failing against the old code and passing against the fix.
Why teams defer it
- The report arrives as a PDF written for an auditor. Each finding needs rewriting as a ticket before anybody can pick it up.
- Some findings are one-line fixes and some are architectural, and the report rarely distinguishes between them.
- The reproduction steps assume the tester's setup, so reproducing one locally is its own piece of work.
- The retest is usually months out, which is far enough away to feel like next quarter's problem.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: fix a single finding from the report so its documented reproduction stops working. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means the documented reproduction no longer reproduces, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- The run stops once the plan is written. Somebody reads the approach and approves it before any code exists, which is the cheapest moment to redirect the work.