Security patching
Hand over the advisory queue and take back reviewed pull requests, one patch at a time.
A new advisory list arrives every week and rarely gets cleared. Nobody argues about fixing it. The argument is about who has the time.
Each advisory becomes its own pull request with the patch and a test for that path.
Add input validation at an unvalidated boundary
Schema plus a rejection test for each malformed shape
Lift a vulnerable transitive dependency
Lockfile diff plus a clean audit run in the pull request
Patch a CVE in a direct dependency
Advisory closed, audit clean, full suite green
Remediate one static-analysis finding
The rule stops firing, plus a test that pins the fix
Set security headers and cookie flags for one surface
Integration test asserting the response headers
Strip personal data from logs a scan flagged
Assertions that the redacted fields never reach the logger
Add the missing authorization check
One test per endpoint proving the wrong actor is refused
Fix one penetration-test finding
The documented reproduction no longer reproduces
Replace an outdated encryption method everywhere it is used
Tests green, plus a clean search recorded in the description
Move a hardcoded credential into the secret manager
Scanner clean and a boot check that reads the new reference
Put the agent team to work on your backlog
Connect a repository and assign SHIP your first issue. Your first missions are free.