Imported from tektonlabs/ai-software-design (.claude/skills/security/remediation-log/SKILL.md). Install upstream with npx skills add tektonlabs/ai-software-design --skill remediation-log. Copyright stays with the author.

name: remediation-log description: Create security remediation tracking documentation for managing vulnerability fixes and security improvements. Essential for security compliance. Phase 10: Security — document 3 of 3.

Remediation Log

Generate security remediation tracking documentation for managing vulnerability fixes and security improvements.

Phase & Position

Prerequisites — must be ✅ SIGNED before this skill runs

Consumed by

Source of truth: .claude/docs/sdlc-model.md. If this table disagrees with the model, the model wins and this table is the bug.

When to Use

• Tracking vulnerability remediation
• Security improvement initiatives
• Compliance remediation
• Audit finding resolution

Inputs Required

Outputs Generated

1. Remediation Log (remediation-log.md)
   • Remediation tracking
   • Status updates
   • Verification records

Instructions

Step 1: Gather Remediation Information

Please provide:
1. Project Name: [name]
2. Remediation Period: [dates]
3. Findings to Track: [from security assessment]
4. SLAs: [remediation timelines]
5. Responsible Teams: [who fixes what]

Step 2: Generate Remediation Log

# Security Remediation Log: [Project Name]

**Period**: [YYYY-MM-DD] to [YYYY-MM-DD]
**Owner**: [CISO]
**Last Updated**: [YYYY-MM-DD]

---

## Remediation Summary

### Overall Progress

| Severity | Total | Fixed | In Progress | Open | Compliance |
|----------|-------|-------|-------------|------|------------|
| Critical | X | X | X | X | X% |
| High | X | X | X | X | X% |
| Medium | X | X | X | X | X% |
| Low | X | X | X | X | X% |
| **Total** | **X** | **X** | **X** | **X** | **X%** |

### SLA Status

| Severity | SLA | On Track | At Risk | Breached |
|----------|-----|----------|---------|----------|
| Critical | 24 hrs | X | X | X |
| High | 7 days | X | X | X |
| Medium | 30 days | X | X | X |
| Low | 90 days | X | X | X |

---

## Active Remediations

### REM-001: SQL Injection Fix

| Field | Value |
|-------|-------|
| **Remediation ID** | REM-001 |
| **Vulnerability ID** | VULN-001 |
| **Severity** | Critical |
| **Status** | In Progress |
| **Assigned To** | [Developer Name] |
| **Start Date** | [YYYY-MM-DD] |
| **Target Date** | [YYYY-MM-DD] |
| **SLA Status** | On Track / At Risk / Breached |

**Vulnerability Summary:**
SQL injection in user search endpoint allowing unauthorized data access.

**Remediation Plan:**
1. [x] Review vulnerable code
2. [x] Implement parameterized queries
3. [ ] Add input validation
4. [ ] Code review
5. [ ] Security retest
6. [ ] Deploy to production

**Progress Updates:**
| Date | Update | By |
|------|--------|-----|
| [Date] | Started code review | [Name] |
| [Date] | Implemented fix in dev | [Name] |
| [Date] | Unit tests passing | [Name] |

**Blockers:**
- [Any blockers or dependencies]

**Verification:**
- [ ] Code review completed
- [ ] Security scan passed
- [ ] Penetration test verified
- [ ] Deployed to production

---

### REM-002: Session Management Improvement

| Field | Value |
|-------|-------|
| **Remediation ID** | REM-002 |
| **Vulnerability ID** | VULN-002 |
| **Severity** | High |
| **Status** | In Progress |
| **Assigned To** | [Developer Name] |
| **Target Date** | [YYYY-MM-DD] |

**Remediation Plan:**
1. [ ] Implement session invalidation on password change
2. [ ] Add session timeout
3. [ ] Implement concurrent session controls
4. [ ] Test changes
5. [ ] Deploy

---

## Completed Remediations

### REM-003: Sensitive Data Exposure Fix

| Field | Value |
|-------|-------|
| **Remediation ID** | REM-003 |
| **Vulnerability ID** | VULN-003 |
| **Severity** | High |
| **Status** | Verified |
| **Completed Date** | [YYYY-MM-DD] |
| **Verified By** | [Security Analyst] |

**Resolution Summary:**
Implemented DTO pattern to filter sensitive fields from API responses.

**Verification Evidence:**
- Security scan report: [Link]
- Code review: [Link]
- Test results: [Link]

---

## Remediation Metrics

### Time to Remediate (Average)

| Severity | Target | Actual | Status |
|----------|--------|--------|--------|
| Critical | 24 hrs | X hrs | 🟢/🔴 |
| High | 7 days | X days | 🟢/🔴 |
| Medium | 30 days | X days | 🟢/🔴 |
| Low | 90 days | X days | 🟢/🔴 |

### Weekly Progress

| Week | Opened | Closed | Net | Total Open |
|------|--------|--------|-----|------------|
| W1 | X | X | +/-X | X |
| W2 | X | X | +/-X | X |
| W3 | X | X | +/-X | X |
| W4 | X | X | +/-X | X |

### Burndown Chart

Open Vulnerabilities 50 ├──● │ ╲ 40 ├────● │ ╲ 30 ├──────●──────Target │ ╲ ╱ 20 ├────────●──● │ ╲╱ 10 ├──────────● │ └──┬──┬──┬──┬── W1 W2 W3 W4 W5

---

## Exception Tracking

### Accepted Risks

| ID | Vulnerability | Accepted By | Reason | Review Date |
|----|---------------|-------------|--------|-------------|
| EX-001 | [VULN-ID] | [CISO] | [Business justification] | [Date] |

### Deferred Remediations

| ID | Vulnerability | Deferred To | Reason | Approved By |
|----|---------------|-------------|--------|-------------|
| DEF-001 | [VULN-ID] | [Date/Release] | [Reason] | [Name] |

---

## Verification Log

| Rem ID | Vuln ID | Fixed Date | Verified Date | Verified By | Method |
|--------|---------|------------|---------------|-------------|--------|
| REM-003 | VULN-003 | [Date] | [Date] | [Name] | Scan + Manual |
| REM-004 | VULN-010 | [Date] | [Date] | [Name] | Automated Scan |

---

## Action Items

| ID | Action | Owner | Due | Status |
|----|--------|-------|-----|--------|
| A1 | Complete REM-001 | [Dev] | [Date] | In Progress |
| A2 | Schedule pentest verification | [Security] | [Date] | Open |
| A3 | Update dependencies | [DevOps] | [Date] | Open |

---

## Escalations

| Date | Issue | Escalated To | Resolution |
|------|-------|--------------|------------|
| [Date] | [Issue] | [Manager] | [Resolution] |

---

## Approval

| Role | Name | Date | Signature |
|------|------|------|-----------|
| CISO | | | |
| Development Lead | | | |
| CISO | | | |

Validation Rules

The agent MUST run these before requesting a signature. Any failure blocks the signature and triggers the improvement flow.

Sources File Generation

Write sources/10-security-remediation-log-sources.md on every generation and every improvement.

# Sources: Remediation Log — {ProjectName}

**Skill:** `remediation-log`
**Phase:** 9 — Security
**Document:** `documentation/10-security/remediation-log.md`
**Version:** v{n}
**Last updated:** {ISO 8601}

---

## Predecessor Documents

| Document | Path | Sections used |
|----------|------|---------------|
| `vulnerability-report` | `documentation/10-security/vulnerability-report.md` | {sections used} |

## Question History

| # | Question | Answer | Asked at |
|---|----------|--------|----------|
| 1 | {question} | {answer} | {ISO 8601} |

## Information Gaps

| Gap | Impact if unresolved | How to close it |
|-----|---------------------|-----------------|
| {gap} | {impact} | {action} |

## Generation Log

| Version | Date | Change | Triggered by |
|---------|------|--------|--------------|
| v1 | {date} | Initial generation | {git_user} |

Document Responsibles & Sign-Off

Required Reviewers

Document Responsibles & Sign-Off

Approval Authority

Related Skills

• Previous: /security/vulnerability-report — must be signed first
• Next: /infrastructure/infra-spec — unlocked once this document is signed
• Feeds: /closure/closure-report

Full flow: .claude/docs/sdlc-model.md