# Fix one penetration-test finding

One finding from the report, fixed against its written reproduction, with a test so it cannot come back.

Category: Security patching
Source: https://letsship.ai/use-cases/fix-one-penetration-test-finding
Published: 2026-08-25

## Goal

Fix a single finding from the report so its documented reproduction stops working.

## Acceptance criteria

- The reproduction steps no longer produce the result
- A test encodes the reproduction so it cannot return
- The fix addresses the cause named in the report, not only the path used to demonstrate it
- The finding reference appears in the pull request

## What lands as proof

A test built from the reproduction steps, failing against the old code and passing against the fix.

## Prompt

Copy this to an agent to open the ticket:

```text
Create a Linear issue in my team and assign it to the SHIP agent.

Title: Fix {finding} from the penetration test

Description: One finding from the report, fixed at the cause named in it rather than at the path used to demonstrate it.

Acceptance criteria:
- The reproduction steps no longer produce the result
- A test encodes the reproduction so it cannot return
- The fix addresses the cause named in the report
- The finding reference appears in the pull request

I will paste the finding below. Replace {finding} with its title and put the reproduction steps in the description verbatim, so the agent can build a test from them.
```

## Questions

### What does the agent actually change?

The ticket is scoped to one outcome: fix a single finding from the report so its documented reproduction stops working. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.

### How do I know the work is done?

The pull request carries the evidence, not only the diff. Here that means the documented reproduction no longer reproduces, so a reviewer can confirm the result without reproducing the work locally.

### How much oversight does this need?

The run stops once the plan is written. Somebody reads the approach and approves it before any code exists, which is the cheapest moment to redirect the work.