Interactive proof walkthrough
Watch one finding become a signed fix.
You follow a real proof path on a signed benchmark artifact: a reachable auth-throttling finding becomes a bounded patch with green CI, a scanner-clean delta, branch-protection review, and a KMS/Sigstore-signed evidence packet — then an auditor accepts it in a scoped evidence room. Use the step rail, the arrow keys, or Previous and Next to move through it.
Step 1 / 7
Finding received
A reachable auth-throttling finding lands from an imported SARIF scan with severity, reachability, owner, and SLA attached.
- Finding ID
SARIF auth-throttle-77e3- Rule
missing-rate-limit-before-auth- Severity
- High
- Reachability
- Reachable — used login route, unauthenticated
- Affected file
apps/web/src/app/api/login/route.ts- Owner
- auth-platform team
- Source
- Imported SARIF (Semgrep)
- SLA
- 7 days — due 2026-06-28
Step 2 / 7
Policy preflight
Before any code runs, the policy engine resolves repo trust, autonomy level, branch protection, reviewer requirement, budget cap, and the sandbox and egress digests it will enforce.
- Repo trust score
- 82 / 100 (governed tier)
- Autonomy level
- L2 — human merge required
- Branch protection
- Enforced: 1 review + required checks
- Reviewer requirement
- 1 code owner (auth-platform)
- Budget cap
- $4.00 / run — estimate $0.83
- Sandbox image digest
sha256:5e6f7a8b9c0d1e2f- Egress policy hash
sha256:1a2b3c4d5e6f7a8b- Trust-boundary attestation
- bench:trust-boundary — 0 critical escapes, signed
Step 3 / 7
Sandboxed patch
Work runs inside an isolated microVM with brokered credentials and deny-by-default egress. The trust-boundary attestation that bounds it is signed and re-verifiable.
- AWH run ID
run-9fe4d158- Sandbox provider
- E2B BYOC / Firecracker microVM
- Isolation
- Single-task microVM, gVisor syscall filter
- Credential proxy
- Brokered GitHub token, repo-scoped, 12-min lease
- Secret exposure
- None — secrets never enter agent context
- AllowedSource repo (github.com)Clone + push over brokered token. On the egress allowlist for this run.
- AllowedPackage registryPinned dependency fetch on allowlist. On the egress allowlist for this run.
- BrokeredGitHub tokenLeased through credential proxy, never in prompt. Mediated through the credential proxy; never exposed to the agent.
- DeniedCloud metadata (169.254.169.254)Instance metadata endpoint. Blocked by deny-by-default egress policy.
- DeniedRFC1918 internal rangeLateral network access. Blocked by deny-by-default egress policy.
- DeniedOpen internetAny host outside the allowlist. Blocked by deny-by-default egress policy.
- DeniedOther tenantsCross-tenant filesystem or memory. Blocked by deny-by-default egress policy.
Step 4 / 7
Bounded patch PR
The change is a small, reviewable diff on a single route boundary, opened as a governed pull request with a blast-radius summary.
Signed remediation PR
boetica/auth-rate-limit-pr · PR #42
Add rate limiting before password verification
/api/login4 lines added, 1 lines removed.- Context:
apps/web/src/app/api/login/route.ts - Context:
export async function POST(request: Request) { - Context:
const body = await request.json(); - Removed:
await password.verify(body.password); - Added:
const requestIp = clientIp(request); - Added:
await limiter.consume(requestIp); - Added:
await password.verify(body.password); - Added:
await audit.append(evidencePacket); - Context:
return Response.json({ ok: true });
Step 5 / 7
Verification
CI runs, tests are added, the scanner re-runs to a clean delta, the contract gate holds, and a human reviewer decision is recorded.
unit-auth— Pass12 tests, incl. new throttling casesroute-smoke— PassLogin route returns 429 past thresholdpolicy-evidence— PassControl mapping present and catalog-validscanner-rerun— PassFinding resolved; 0 net-new findingscontract-gate— PassAPI contract unchanged for callers
| Finding | Before | After | State |
|---|---|---|---|
| auth-throttle-77e3 (High) | Open | Resolved | Resolved |
| Net-new findings introduced | — | 0 | Resolved |
| Unrelated open findings | Unchanged | Unchanged | Unchanged |
- Tests added
- auth-rate-limit.test.ts — 3 cases
- CI duration
- 7m 42s, all checks green
- Reviewer decision
- Approved by code owner; branch protection satisfied
- Merge state
- Human merge required (L2) — not auto-merged
Step 6 / 7
Signed evidence packet
The run is sealed into an evidence packet: hash chained to the previous packet, verifier-checked, control-mapped, written to immutable storage, and KMS/Sigstore-signed.
Signed evidence packet
Verifier passed2026-06-24. Verifier re-ran the packet and the hash chain held.Representative packet. The live signed packet is re-verifiable from its hash chain and signature before procurement review.
- Packet hash
sha256:91f4e2a0c6f36b12- Previous hash
sha256:55c6f36b71d3ee08- Schema version
evidence/2026-06- Immutable storage
worm://boetica-evidence/acme/run-9fe4d158.json- Control mapping
- SOC 2 CC6.6
- NIST 800-53 AC-6
- OWASP ASVS 2.2.1
- Finding
sha256:77e34a90 - Patch diff
sha256:42aa17c0 - CI + scanner
sha256:55c6f36b - Evidence packet
sha256:91f4e2a0 - Signature
sha256:c6f36b12
- Algorithm
- ECDSA P-256 (cosign keyless)
- KMS key
- gcpkms://projects/boetica-prod/locations/global/keyRings/evidence/cryptoKeys/packets
- Sigstore bundle
- sigstore-bundle://rekor/boetica/scorecards
- Signer
- boetica-evidence-signer
- Signed at
- 2026-06-24T08:14:00Z
- Digest
- sha256:91f4e2a0c6f36b12
Verify the packet: recompute the packet hash, confirm it chains to the previous hash, and check the signature against the transparency bundle. Nothing here has to be trusted on our word.
Step 7 / 7
Evidence room
The packet is shared through a scoped, expiring, verifier-backed room where an auditor and CISO accept it and procurement exports JSON, HTML, or PDF.
Scoped evidence room
Auth throttling remediation — scoped evidence room
Acceptance
- External auditorAccepted · 2026-06-25
- Customer CISOAccepted · 2026-06-25
Procurement export
- JSON export: Signed evidence packet (machine-verifiable)
- HTML export: Human-readable evidence report
- PDF export: Procurement export with signature page
Step 1 of 7: Finding received
Do the same on your finding
Turn one of your findings into a signed fix.
Open the remediation scorecard behind this walkthrough, or start a scoped evaluation on a real finding of your own.