Repairs

For each confirmed finding, the repairer writes the smallest change that removes the exploit path, then verifies it.

• The original exploit no longer reproduces in the replica.
• Your existing test suite passes.
• No new findings are introduced by the change.

Repairs are opened as pull requests with the finding, the reasoning and the verification results attached. Opsec never merges its own changes.

# opsec.yaml
repairs:
  enabled: true
  branch_prefix: opsec/fix-
  reviewers: ["@acme/security"]
  max_open: 10