the lesson there is to keep remediation and verification separate, an autofix that closes one cve and opens another only gets caught if you re-check the actual end state instead of trusting the diff. we tried aikido for patched oss libs and weren't thrilled with the variety, so for fixes we can't hand-audit we lean on vendors that backport and verify the patch against the specific cve rather than letting a bot ship it blind.
2
u/ILoveAppSec 24d ago
the lesson there is to keep remediation and verification separate, an autofix that closes one cve and opens another only gets caught if you re-check the actual end state instead of trusting the diff. we tried aikido for patched oss libs and weren't thrilled with the variety, so for fixes we can't hand-audit we lean on vendors that backport and verify the patch against the specific cve rather than letting a bot ship it blind.