Security Hardening (FIX phase)

Overview

Turn findings into correct, verified fixes. Fix the root cause at the right layer, add defense in depth, then re-test to prove the hole is closed.

Core principle: A fix you didn't re-test is a hope, not a fix. Reproduce the original exploit and confirm it now fails.

Process per finding

1. Root cause — why is untrusted data reaching the sink? Fix there, not by blocklisting symptoms.
2. Apply the secure pattern — see table below.
3. Defense in depth — add a second independent control (validation + parameterization, etc.).
4. Re-test — rerun the exact PoC from active-pentest/the audit; confirm it fails now.
5. Regression — add a test so it can't silently come back.