Fix Security Finding
Fix one finding without broad refactors.
Workflow
- Read
fix-findingfrom Codex Security if available. - Confirm source, sink, control point, affected asset, and attacker input.
- Reproduce, encode, or reason through the failure path.
- Apply the smallest correct fix.
- Add regression coverage when the repo supports tests.
- Validate that the old path is blocked and normal behavior still works.
Output
- finding fixed
- files changed
- regression coverage
- validation commands
- remaining proof gaps
Rules
- Do not fix unrelated findings.
- Do not hide uncertainty.
- Do not weaken validation or authorization for convenience.