Security Loop — find → fix → re-test → signoff¶

Deterministic flow from a finding to either resolution or explicit acceptance.

Triage rules by severity¶

Fix handoff criteria (to coding agent)¶

A finding is eligible for automated fix handoff only if:

1. Severity is critical or high (or owner explicitly opts in for medium).
2. Confidence is at least medium.
3. Reproduction steps are present and complete.
4. Remediation recommendation is concrete (not "rewrite this module").
5. Patch scope fits within the bounded-edit rule (specific files / specific behavior).
6. Owner has authorized automated remediation for this repo.

Loop steps¶

1. Triage finding per the table above.
2. If handoff: invoke secure-fix-handoff.md runbook.
3. Coding agent applies patch under the standard default-task-loop in a sandboxed branch.
4. Re-test in the sandbox using the same test-plan (and any newly added regression test).
5. Re-evaluate finding:
6. closed — patch verified; mark verified; update finding-report verification block.
7. partial — issue mitigated but residual risk remains; document and either iterate or accept.
8. open — go back to step 2 (max iterations below).
9. Iteration cap. Default 3 iterations per finding before mandatory human escalation.
10. Signoff checklist when loop ends:
11. All critical findings closed or explicitly accepted with rationale.
12. All high findings closed or explicitly accepted with rationale and time-bound waiver.
13. Re-tests green.
14. No new findings of equal-or-greater severity introduced by patches.
15. Audit events present for every step (SPB-12).

Acceptance with rationale¶

If a finding is accepted (not fixed):

• Owner approves with a written rationale.
• Compensating controls listed.
• Re-evaluation date set (default 90 days).
• Recorded in the finding report and the security audit log.