SO
SecOps WorkbenchSprint 7 · Day 8/10
Agent working
?page=remediation&issue=issue-sec-1745&tab=verdict
SEC-1745·FOR-5183·order-service

SQL injection in OrderRepository.findByCustomer

Critical CWE-89 spring-sql-injection@2.3
Previous Next
Current stage
Awaiting human approval
5 of 7 · 71%
TriagedPlannedCodedTestedApprovalMergeVerified
Overview Evidence 12 Human Gates 1 Regression Verdict
System recommendation

Approve & merge — low residual risk

All checks green. Three of four approvers signed off. The change matches a Class A clean-fix pattern with 47 prior successful uses. Rollback path is a single git revert. You're the last required sign-off.

Checks
6 / 6 passed
Reviewers
3 of 4
Playbook
98% rate
SLA window
6 days left

Approver votes

Quorum met · 3 of 4 · final required: @alice
Developer Agent
implemented fix · spring-sql-injection@2.3
Applied playbook cleanly. Single-file change. 3 regression tests added. Build green, Fortify rescan clean.
Approve 2h ago
Reviewer Agent
automated review · checked diff, tests, scope
Diff matches playbook expected output exactly. No collateral changes. Test coverage adequate. Recommend approve.
Approve 11m ago
JR
J. Reviewer
on-call security engineer · order-service code owner
LGTM — clean parametric replacement. Tests cover the obvious payloads. Routing to Alice for critical-severity sign-off.
Approve 10:31
AB
Alice Brown You
security lead · required for critical severity
Awaiting 8m open

Residual risk

Low
15 / 100
Surface area minimal — single file, single method, +18 / −4 lines
Pattern proven — playbook used 47× before, 98% clean-merge rate
No auth/crypto/migration touched — diff stays inside /repository/
Live in production — change goes to main and triggers deploy pipeline within 30 min
Rollback plan
Single-commit revert is sufficient · git revert 9a7f3d2 · no DB migration to undo · estimated time-to-rollback: 4 minutes including redeploy.

Signal rollup

All green
Overview · closure blockers
3 of 4 cleared · only this approval remains
3/4
Evidence · artifacts collected
12 artifacts · 5 sources · 100% hashed & signed
12 / 12
Regression · check matrix
Build · units · regression · rescan · scope · deps — all pass
6 / 6
Side-effect probes
API · DB · perf · auth · config · deps — no drift
6 / 6
Human Gates · pre-checks
CI · rescan · approvers · scope · merge — ready
5 / 5
Playbook track record
spring-sql-injection@2.3 · 47 prior applications
98%
No waiver requested
Standard approval flow applies. Critical severity does not require an exception or risk acceptance — the fix simply closes the finding.

Your decision

SLA: 6 days left · 8 min open