Remediate a security finding
Reproduce a finding in a constrained workspace, repair it, and keep validation and approvals attributable.
What does this security workflow workflow cover?
Reproduce a finding in a constrained workspace, repair it, and keep validation and approvals attributable.
What should an evaluator inspect?
Inspect the stated requirements, workspace boundary, validation evidence, approval points, and stated deployment scope rather than inferring results from an example workflow.
Is this customer proof?
No. Workflow pages describe an evaluation model and may use fictional product artifacts. They do not assert customer adoption, outcome, or availability evidence.
Can we run this workflow today?
A released self-managed artifact and tested quickstart are not published. Review the self-hosted requirements or register interest in future Cloud or Enterprise offerings.
What is the next step?
Use the ungated sample run and pilot scorecard to frame the evaluation, then choose a request path only if the operating model fits.
Starting condition and desired outcome
A scanner or review reports a vulnerability, but reproduction conditions and acceptable remediation are unclear. The outcome is a scoped change with regression evidence and explicit security review.
The current manual workflow
The BranchRunner workflow
- 01Classify and constrain
Record severity source, affected component, access needs, and non-disclosure boundary.
- 02Reproduce safely
Use an isolated workspace with minimum secrets and network access.
- 03Repair and validate
Apply the bounded change and rerun the finding plus regression checks.
- 04Security approval
A named reviewer inspects evidence and approves or rejects delivery.
Evidence produced
The run keeps claims separate from checks and decisions. The evidence below describes the record, not a guaranteed outcome.
Product example. Repository, checks, and identities are illustrative; configure them for your system.
Where a person stays in control
A person confirms scope and disclosure handling.
Secret and network access is granted per step.
Exceptions remain explicit decisions, not agent conclusions.
External communication follows your existing security process.
What the workflow can produce
Integrations, deployment, and edition fit
Validate the workflow against one real repository
Bring the starting condition, required checks, and approval boundaries. We will identify what can be configured today and what remains deployment work.