From ba608251676313a46309a8ad969790a5ab189a0f Mon Sep 17 00:00:00 2001 From: John Cardinal Date: Sat, 24 Oct 2026 06:00:25 -0700 Subject: [PATCH] Security review: finding IDs are permanent Cases will refer to finding numbers, so they are never renumbered or reused. Co-Authored-By: Claude Opus 5.5 --- devdocs/modernization/SECURITY-REVIEW.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/devdocs/modernization/SECURITY-REVIEW.md b/devdocs/modernization/SECURITY-REVIEW.md index 113fecd3..077fd66f 100644 --- a/devdocs/modernization/SECURITY-REVIEW.md +++ b/devdocs/modernization/SECURITY-REVIEW.md @@ -184,6 +184,9 @@ customer reaching another's data; or serious abuse of the company's resources) Status: *candidate* (seen in code, not yet confirmed), *confirmed*, *fixed in case NNNN*, *accepted*. +**Finding IDs are permanent:** never renumber or reuse them; John's cases refer to them. New findings +take the next free number; a fixed or accepted finding keeps its ID and changes status. + | ID | Severity | Status | Title | |---|---|---|---| | F41 | **Critical** | confirmed (code) | F5 also in Sockeye (internet-facing admin login) and in the 8.2.x business AyaNova server |