# Remediate one static-analysis finding

One finding from the scanner, fixed at the cause and pinned by a test so the rule cannot start firing again.

Category: Security patching
Source: https://letsship.ai/use-cases/remediate-one-static-analysis-finding
Published: 2026-08-25

## Goal

Fix the code behind a single static-analysis finding and add a test that fails if it comes back.

## Acceptance criteria

- The rule reports clean on the file
- A test covers the behaviour the fix changed
- No suppression comment is added
- The pull request explains why the original code was flagged

## What lands as proof

The scanner clean on that rule, and a test that fails against the code as it was written before.

## Prompt

Copy this to an agent to open the ticket:

```text
Create a Linear issue in my team and assign it to the SHIP agent.

Title: Fix {rule} in {file}

Description: Fix the code behind one static-analysis finding, at the cause rather than by suppressing it.

Acceptance criteria:
- The rule reports clean on the file
- A test covers the behaviour the fix changed
- No suppression comment is added
- The pull request explains why the original code was flagged

Before you create the issue, run the static-analysis tool in this repository and replace {rule} and {file} with a real finding. Prefer one in code that has test coverage already.
```

## Questions

### What does the agent actually change?

The ticket is scoped to one outcome: fix the code behind a single static-analysis finding and add a test that fails if it comes back. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.

### How do I know the work is done?

The pull request carries the evidence, not only the diff. Here that means the rule stops firing, plus a test that pins the fix, so a reviewer can confirm the result without reproducing the work locally.

### How much oversight does this need?

None is required before the run starts. Every claim this ticket makes can be checked by machine, so the agent works straight through and a person reviews the finished pull request like any other.