SourceSARIF or GRC finding
Findings, solved
When a finding matters, Boetica fixes it.
Send findings from scanners or GRC workflows. Boetica checks reachability, writes the patch, adds tests, and records the proof needed for review and audit.
Finding trace
A finding becomes a fix, not a queue item.
The remediation view follows source, reachability, owner, patch, test proof, and control mapping before it asks a human to merge.
ReachUsed route, package, or policy path
PatchBounded remediation PR
EvidenceHash, CI, policy, controls
finding.link(AUTH-1847) -> route /api/loginpatch.scope() -> auth boundary onlyevidence.map() -> CC6.6 / AC-6reachablerollback notedcontrol mapped
Reachability first
Prioritization starts with what is actually used, exposed, and owned in the repo.
Blast-radius note
Every fix explains the files touched, tests added, and rollback path.
Control mapping
Security and compliance changes map to SOC 2 and NIST control families when relevant.
Ingest
Start from the tools your team already trusts.
SARIF and scanner outputs become task candidates with source, severity, reachability, and owner context.
- CVE and dependency issues
- IAM and RLS gaps
- Policy-as-code findings
Patch
A remediation PR should feel small enough to trust.
The change is scoped tightly enough for a human reviewer to understand what was touched, why it changed, and how to back it out.
- Small diffs
- Added tests
- CI checks
- Rollback note
Signed remediation PR
boetica/auth-rate-limit-pr
@@ apps/web/src/app/api/login/route.ts- await password.verify(body.password)+ await limiter.consume(requestIp)+ await password.verify(body.password)+ await audit.append(evidencePacket)
evidence packetKMS + Sigstore (cosign)
- packet hash
- 91f4e2a0
- prev hash
- 5e1c8a44
- trust boundary
- sandbox attested · egress denied
- merge policy
- platform-eng / human merge
SOC 2 CC6.6signedNIST AC-6signed
Evidence
The audit packet travels with the fix.
Boetica records what changed, why it changed, who approved it, and how the verification completed.
- Tamper-evident hash
- Policy decision
- Timestamp
- Control family