Manage findings and incidents

Use a finding for a security weakness that needs remediation. Use an incident for an active event requiring containment and recovery.

Finding lifecycle

Open → Triaged → Remediating → Fixed → Verified → Closed.

Record severity, affected environment, owner and due date. Severity is fixed on creation in V1; a correction requires a new record with an explanation in the remediation history. Do not downgrade a finding to bypass release controls.

Marking a finding Fixed requires remediation notes and a complete fix commit SHA. A different member must verify the fix. Critical and high findings also cannot be verified by their original reporter. Verified findings remain unresolved for release purposes until Closed.

A fixed or verified finding can return to Remediating. A closed finding can reopen. Records cannot be hard-deleted.

Risk exceptions

An independent owner with recent MFA may approve a time-bound exception for a non-critical finding. Required evidence still has to pass. An exception never repairs failed tenant isolation or an exposed credential.

Incident lifecycle

Detected → Contained → Eradicated → Recovered → Postmortem complete.

Credential incidents require revocation and rotation timestamps before Eradicated. Completing the incident requires a postmortem link. Active incidents block release evaluation.

Leak metadata

Store only a SHA-256 fingerprint, credential type, safe summary, timestamps and protected evidence references. Never paste the credential itself. BuildVouch does not revoke or rotate upstream credentials; use the provider's approved procedure.

Corrections

Transitions are audited. Fix mistakes through a new event or record; preserve the original incident and evidence history.