Record a treatment for security-relevant issues

What the check reads

The verify-stage warning applies when cve_surface is possible, likely or confirmed, or when recognized security terms identify the issue as security-relevant. It requires a nonblank remediation or mitigation field. A remediation_exemption with reviewer and rationale is an alternative. The rule is independent of a high-severity label, so lowering severity alone does not remove a security-named issue from its scope.

proof audit --check known_issue_security_remediation_present

An illustrative case

Illustrative case: a medium-severity cross-tenant access issue has a reproducer and affected requirement, but no treatment. Record whether disabling the affected endpoint contains current exposure and which authorization change is planned. Keep the temporary control distinct from the permanent repair, with the versions and conditions to which each applies.

Resolve the finding

1. Read the security-relevance reason and confirm that the issue is classified accurately.
2. Document a concrete mitigation or remediation, including the target behavior and any remaining exposure.
3. If no treatment is appropriate, retain the reviewer’s specific rationale. Rerun the check and separately verify any implemented control.

What a clear result means

Presence of treatment text is the checked fact. It does not prove the control was deployed, that it is effective, or that residual risk was accepted. Preserve the corrective Change and executed evidence alongside the plan, and leave unsupported deployment or closure states explicit.

Continue with one real issue

Security relevance consistent · Risk acceptance

Bring one finding, its requirement and the current evidence to scope a walkthrough of what your reviewer can establish and what still needs work.