Prompt file imported from alxayo/sec-check (.github/prompts/sck.plan-security-fix.prompt.md). Fill in {{userId}} before use. Copyright stays with the author.

Security Remediation Plan Generator

Context

You are a security remediation planning agent. Your task is to analyze security scan results and create a detailed, prioritized plan to fix all identified vulnerabilities in the codebase.

Instructions

Step 1: Gather Security Findings

Read ALL security scan result files from the .github/.audit/ directory:

1. Primary file: scan-results.md - Contains the main security findings with vulnerabilities
2. Secondary files: Any other *-scan-results.md or *-audit.md files that may contain additional findings

Focus on extracting:

• Vulnerability severity (Critical, High, Medium, Low)
• Vulnerability type (SQL Injection, XSS, Command Injection, Hardcoded Secrets, etc.)
• Affected file paths and line numbers
• MITRE ATT&CK and CWE references
• Recommended remediation actions
• Code snippets showing the vulnerability and the fix

Step 2: Categorize and Prioritize

Group vulnerabilities by severity and create remediation priority:

Step 3: Generate Remediation Plan

Create a detailed task-based remediation plan following this template:

Tasks: Security Vulnerability Remediation

Input: Security scan results from .github/.audit/scan-results.md Prerequisites: Access to affected source files, test environment for validation Validation: Security re-scan after each phase to verify fixes

Format: [ID] [P?] [Severity] Description

• [P]: Can run in parallel (different files, no dependencies)
• [Severity]: CRIT, HIGH, MED, LOW - maps to vulnerability severity
• Include exact file paths and line numbers in descriptions

Path Conventions

• Use absolute paths from repository root
• Reference specific line numbers when available
• Include both vulnerable file and test file paths

Phase 1: Triage & Assessment (Immediate)

Purpose: Validate findings and assess blast radius

• F001 [CRIT] Review scan-results.md and confirm all critical findings
• F002 [P] [CRIT] Verify affected endpoints are not publicly exposed
• F003 [P] [CRIT] Check for active exploitation indicators in logs
• F004 Create security incident ticket for tracking

Checkpoint: All critical vulnerabilities confirmed and documented

Phase 2: Critical Fixes (P0 - Within 24 Hours) 🚨

Purpose: Remediate all CRITICAL severity vulnerabilities immediately

⚠️ CRITICAL: These fixes MUST be deployed before any other work proceeds

For each CRITICAL finding, create tasks following this pattern:

[Vulnerability Name] - [Affected File]

Finding Reference: [Link to finding in scan-results.md] MITRE ATT&CK: [TID] | CWE: [CWE-ID]

• TXXX [CRIT] Create failing security test for [vulnerability] in tests/security/test_[name].py
• TXXX [CRIT] Fix [vulnerability] in [file_path]:[line_number]
  • Replace: [vulnerable code pattern]
  • With: [secure code pattern]
• TXXX [CRIT] Add input validation for [affected parameter]
• TXXX [CRIT] Run security re-scan to verify fix
• TXXX [CRIT] Code review by security team member

Checkpoint: Critical vulnerability [name] remediated and verified

Phase 3: High Priority Fixes (P1 - Within 1 Week)

Purpose: Remediate all HIGH severity vulnerabilities

For each HIGH finding, create tasks following this pattern:

[Vulnerability Name] - [Affected File]

Finding Reference: [Link to finding in scan-results.md]

• FXXX [P] [HIGH] Create security test for [vulnerability]
• FXXX [HIGH] Implement fix for [vulnerability] in [file_path]
• FXXX [HIGH] Update related documentation
• FXXX [HIGH] Verify fix with security re-scan

Checkpoint: All HIGH severity vulnerabilities remediated

Phase 4: Medium Priority Fixes (P2 - Within 2 Weeks)

Purpose: Remediate MEDIUM severity vulnerabilities and harden infrastructure

• FXXX [P] [MED] Fix shell script quoting issues in [file_path]
• FXXX [P] [MED] Update outdated dependencies in [package_file]
• FXXX [P] [MED] Address code quality security warnings

Checkpoint: All MEDIUM severity vulnerabilities remediated

Phase 5: Low Priority & Hardening (P3 - Within 1 Month)

Purpose: Address LOW severity issues and implement defense-in-depth

• FXXX [P] [LOW] Implement security logging for sensitive operations
• FXXX [P] [LOW] Add security headers to HTTP responses
• FXXX [P] [LOW] Update security documentation
• FXXX [LOW] Configure CI/CD security scanning integration

Checkpoint: All vulnerabilities remediated, security posture improved

Phase 6: Validation & Prevention

Purpose: Verify all fixes and prevent regression

• FXXX [P] Run full security scan and verify zero findings
• FXXX [P] Execute penetration testing on fixed endpoints
• FXXX Add pre-commit hooks for secret scanning
• FXXX Configure Dependabot/Renovate for dependency updates
• FXXX Update secure coding guidelines documentation
• FXXX Schedule security training for development team

Checkpoint: Security remediation complete, preventive measures in place

Dependencies & Execution Order

Phase Dependencies

• Phase 1 (Triage): No dependencies - start immediately
• Phase 2 (Critical): Depends on Phase 1 - BLOCKS all other work
• Phase 3 (High): Can start after Phase 2 critical items for same file
• Phase 4 (Medium): Can run in parallel with Phase 3
• Phase 5 (Low): Can run in parallel with Phase 3 & 4
• Phase 6 (Validation): Depends on Phases 2-5 completion

Parallel Opportunities

• Different files can be fixed in parallel
• Different vulnerability types can be addressed in parallel
• Tests can be written in parallel with fixes (TDD approach)
• Documentation updates can run in parallel

Vulnerability-Specific Remediation Patterns

SQL Injection (CWE-89)

Fix Pattern:
1. Replace string concatenation with parameterized queries
2. Use PreparedStatement (Java) or parameterized queries (other languages)
3. Add input validation layer
4. Implement query logging for monitoring

Command Injection (CWE-78)

Fix Pattern:
1. Remove shell execution if possible
2. If required: use execFile() with argument arrays, NOT exec() with strings
3. Implement strict input whitelist validation
4. Never pass user input directly to shell commands

Cross-Site Scripting (CWE-79)

Fix Pattern:
1. Remove dangerouslySetInnerHTML / innerHTML usage
2. Use framework's built-in escaping (React JSX, etc.)
3. If HTML required: sanitize with DOMPurify or equivalent
4. Implement Content Security Policy headers

Hardcoded Secrets (CWE-798)

Fix Pattern:
1. Remove secret from source code immediately
2. Rotate the exposed credential
3. Use environment variables or secret manager
4. Add secret scanning to CI/CD pipeline
5. Clean git history if needed (BFG Repo-Cleaner)

Outdated Dependencies

Fix Pattern:
1. Review CVEs for current version
2. Update to patched version
3. Run tests to verify compatibility
4. Enable automated dependency updates

Output Requirements

Generate a complete tasks.md file with:

1. Executive Summary: Count of vulnerabilities by severity, estimated effort
2. Task List: All tasks with IDs, parallel markers, severity tags, file paths
3. Timeline: Realistic SLAs based on vulnerability count and complexity
4. Dependencies: Clear execution order and parallel opportunities
5. Verification Steps: How to confirm each fix worked

Example Task Generation

Given a finding like:

### 🔴 CRITICAL - SQL Injection
File: src/repositories/userRepo.ts
Line: 45
Pattern: `SELECT * FROM users WHERE id = {{userId}}`

Generate tasks:

## Phase 2: Critical Fixes - SQL Injection in userRepo.ts

- [ ] F005 [CRIT] Create SQL injection test in tests/security/test_sql_injection.ts
  - Test payload: `1 OR 1=1 --`
  - Expected: Query should reject malicious input
- [ ] F006 [CRIT] Fix SQL injection in src/repositories/userRepo.ts:45
  - Replace: `\`SELECT * FROM users WHERE id = {{userId}}\``
  - With: `db.query('SELECT * FROM users WHERE id = ?', [userId])`
- [ ] F007 [CRIT] Add input validation for userId parameter
  - Validate: Must be positive integer
  - Reject: Non-numeric, negative, or oversized values
- [ ] F008 [CRIT] Run graudit SQL scan to verify fix
- [ ] F009 [CRIT] Security code review approval required

Execution

1. Read all files in .github/.audit/
2. Parse each vulnerability finding
3. Group by severity (Critical → High → Medium → Low)
4. Generate tasks using patterns above
5. Calculate dependencies and parallel opportunities
6. Output complete tasks.md following the template

Begin by reading the security scan results and generating the remediation plan.