Definition
Vulnerability fix proof is evidence that the original vulnerability finding no longer applies to the specific artifact being released. It goes beyond ticket closure, pull request merges, or claims that the code was changed. It requires a retest, runtime observation, or other independent corroboration showing the risk is absent in the release candidate.
Fix proof is one of the most common proof artifacts in release-evidence verification. It is also one of the most commonly missing: many organizations close vulnerability tickets when the code is changed, without proving the change removed the risk.
Why it matters
Closed tickets and merged pull requests are workflow events, not proof. Regulators, auditors, and incident reviewers need to know whether the vulnerability was actually retired. Vulnerability fix proof provides that assurance and prevents organizations from mistaking activity for risk reduction.
Example
A static analysis tool reports a SQL injection in commit A. The developer opens a pull request that changes the query construction. Ticket closure happens when the PR merges. Vulnerability fix proof happens when a retest of the release candidate shows the vulnerable pattern is absent and a reviewer attests that the fix was reviewed against the secure-coding standard.
Related terms
- Proof artifact — A record that can be independently examined to support or refute a claim about a software release.
- Release-evidence verification — The practice of determining whether the evidence behind a software release decision satisfies versioned policy.
- Defensible release decision — A release decision whose basis can be reviewed and explained long after the decision was made.
- Policy-version binding — Associating a release decision with the exact version of policy that was active when the decision was made.