orbyn-security-remediation ยท diff
git:20261025.251cd2e to git:20261101.8be107b
12 added, 20 removed. Audit A to A.
---
name: orbyn-security-remediation
- description: Investigate and resolve existing Orbyn security findings, record evidence and add preventive checks without starting a security scan.
+ description: Investigate and resolve existing security findings from Codex Security or a comparable record, capture evidence and add preventive checks without starting a security scan.
---
# Existing security findings
- ## Permission and evidence
-
- - Never run, restart or rejoin any Codex Security scan unless the user explicitly requests that scan. Ordinary review, checkpoint qualification and local QA permission do not authorize scanning.
- - Read saved findings and preserve original scan ID, revision, outcome and coverage. A canceled or failed scan is partial evidence, never a clean qualification.
- - Consolidate duplicate causes but retain every original finding ID in the task ledger.
- - Trace each reported path against current source. Classify confirmed, already safe, duplicate, intentional with documented invariant, or unresolved. Do not equate a scanner label with a verified exploit.
+ Never run, restart or rejoin any Codex Security scan unless the user explicitly requests that scan. Ordinary review, checkpoint qualification and local QA permission do not authorize scanning. Never launch a scan to close a remediation ticket.
- ## Fix the boundary
+ ## Method
- - The assigned engineer owns patches; use an independent reviewer when requested. Preserve unrelated work and candidate provenance. Follow [project instructions and scope](../orbyn-workflow/references/project-policy.md#scope-and-evidence) for testing and delivery scope.
- - State the violated invariant and trace attacker-controlled input to the actual
- authority or effect boundary. Check current callers, alternate paths and the
- legitimate behavior that must remain available.
- - Correct that owner with appropriate validation, authorization, atomicity,
- resource limits or compatibility. Preserve least privilege and avoid exposing
- secrets or user content in logs, fixtures or reports.
- - Use [conditional finding patterns](references/finding-patterns.md) only when the
- finding involves those systems. Keep concrete race/revocation/migration controls
- from the relevant pattern; do not apply every historical product check.
+ 1. **Read saved findings** and preserve original scan ID, revision, outcome and coverage. A canceled or failed scan is partial evidence, never a clean qualification.
+ 2. **Consolidate duplicate causes,** retaining every original finding ID in the task ledger.
+ 3. **Classify each finding** by tracing its reported path against current source: confirmed, already safe, duplicate, intentional with documented invariant, or unresolved. Do not equate a scanner label with a verified exploit.
+ 4. **State the violated invariant** and trace attacker-controlled input to the actual authority or effect boundary. Check current callers, alternate paths and the legitimate behavior that must remain available.
+ 5. **Correct that owner** with appropriate validation, authorization, atomicity, resource limits or compatibility. Preserve least privilege, and keep secrets and user content out of logs, fixtures and reports. Use [conditional finding patterns](references/finding-patterns.md) only when the finding involves those systems: keep concrete race/revocation/migration controls from the relevant pattern, without applying every historical product check.
+ 6. **Test** the reported trigger, an alternate bypass and a legitimate control when authorized. Update preventive checks in the owning tests when testing is authorized, or in the authorized skill scope.
+ 7. **Close out** in a Markdown task ledger: finding IDs, affected source, invariant, patch, focused checks and remaining limits. Mark fixed only with evidence; keep unavailable checks open.
- ## Closeout
+ ## Ownership
- Record finding IDs, affected source, invariant, patch, focused checks and remaining limits in a Markdown task ledger. Test the reported trigger, an alternate bypass and a legitimate control when authorized. Mark fixed only with evidence; keep unavailable checks open. Update preventive checks in the owning tests when testing is authorized, or in the authorized skill scope. Never launch a scan to close a remediation ticket.
+ The assigned engineer owns patches; use an independent reviewer when requested. Preserve unrelated work and candidate provenance. Follow [project instructions and scope](../orbyn-workflow/references/project-policy.md#scope-and-evidence) for testing and delivery scope.