Missions / Security
Dependency vulnerability remediation with exploitability gate
Vulnerability remediated with evidence of exploitability assessment and fix verification
This mission is planned. No implementation exists today.
Architecture summary
Context intelligence correlates vulnerability finding with dependency graph. Exploitability assessment determines if vulnerability is reachable. Remediation proceeds only for exploitable findings with evidence verification.
Stages
Ingestion
Receive vulnerability finding from scanner
Evidence: Vulnerability report with severity
Correlation
Map vulnerability to dependency and version
Evidence: Dependency graph with affected path
Exploitability assessment
Determine if vulnerability is reachable in current configuration
Evidence: Reachability analysis with exploitability verdict
Remediation
Apply fix for exploitable vulnerabilities only
Evidence: Updated dependency with fix commit
Verification
Verify fix resolves vulnerability
Evidence: Scanner re-run with passing results
Controls
Exploitability gate
Remediation proceeds only for exploitable findings
Severity threshold
Low-severity non-exploitable findings may be deferred
Composition
- Capabilities used
- context-intelligence, evidence-verification
- Integration categories used
- source-control, ci-cd, observability
Constraints
- Exploitability assessment required for all findings
- Non-exploitable findings documented but not auto-remediated
- Fix verification required before closure
Related design notes
- Reachability analysis distinguishes real risk
- Prevents alert fatigue from non-exploitable findings
- Designed for SCA scanner integration