fleet-patching-findings

Automating security vulnerability patching involves ingesting a verified findings set and generating a surgical patch per vulnerability, then applying them as individual commits. The workflow uses a blind-review gate to ensure safety and enforces a one-commit-per-finding policy.

A blind-review gate in automated patch generation acts as a safety checkpoint during the vulnerability patching process. It evaluates the proposed code changes without exposing sensitive triage details, preventing leakage while ensuring the patch is safe to apply.

To start patching verified code vulnerabilities, provide a TRIAGE.json or VULN-FINDINGS.json file alongside the target writable repository. The workflow then ingests the findings, generates surgical patches, reviews them, and applies the committed fixes automatically.

Yes, you can generate one commit per security finding. The workflow strictly enforces a one-commit-per-finding policy during application, ensuring each verified vulnerability receives its own surgical commit in the code repository.

The best way to apply surgical patches for triage findings without leaking sensitive details is using an automated workflow with a blind-reviewer gate. This approach patches true positives as commits while redacting sensitive context during the review phase.