Fix Security Vulnerabilities

You are tasked with fixing security vulnerabilities. This security remediation should address identified threats while maintaining system functionality and minimizing disruption to existing workflows.

**VULNERABILITY ASSESSMENT**

- **What specific vulnerabilities need to be addressed?**: *List CVE numbers, security scanner findings, or identified security gaps that require remediation.*
- **What is the severity and risk level of each vulnerability?**: *Categorize threats by criticality (Critical, High, Medium, Low) and potential business impact.*
- **What attack vectors or exploitation scenarios are we protecting against?**: *Describe how these vulnerabilities could be exploited and what systems or data are at risk.*

**SYSTEM BOUNDARIES**

- **What boundaries should we set for Blitzy during this security remediation?**: *Define the limits within which Blitzy should operate (e.g., "only modify authentication-related components" or "limit changes to the API layer and dependencies").*
- **What components or layers of the system are affected by these vulnerabilities?**: *Identify the scope of changes across frontend, backend, database, infrastructure, and third-party integrations.*
- **What existing functionality must remain completely untouched?**: *Identify critical features, workflows, and capabilities that must continue working exactly as they do today.*
- **What existing interfaces, APIs, or contracts must remain unchanged?**: *List any external or internal interfaces that cannot be modified during security implementation.*

**TECHNICAL IMPLEMENTATION**

- **How should security fixes be integrated into the existing architecture?**: *Specify whether fixes should be implemented as patches, middleware, configuration changes, or architectural modifications.*
- **What dependencies, libraries, or packages need to be updated or replaced?**: *List vulnerable components that require version upgrades or alternative implementations.*
- **What new security controls or defensive measures should be implemented?**: *Describe additional protections like input validation, access controls, encryption, or monitoring that should be added.*
- **How will these changes affect system performance or user experience?**: *Identify any potential impacts on latency, throughput, or user workflows that need to be considered.*
- **What configuration or environment changes are required?**: *Specify updates needed for environment variables, security headers, firewall rules, or deployment configurations.*

**TESTING & VALIDATION REQUIREMENTS**

- **What security test cases should be covered to verify the fixes?**: *List penetration tests, vulnerability scans, or security-focused test scenarios that must pass.*
- **What regression testing is needed to ensure existing functionality remains intact?**: *Specify test suites or user flows that must continue working after security changes.*
- **What tools or processes will be used to validate security improvements?**: *Identify security scanners, code analysis tools, or manual testing procedures for verification.*
- **How will the effectiveness of security controls be measured?**: *Define metrics or monitoring that will confirm vulnerabilities are properly addressed.*

**RISK MANAGEMENT**

- **What are the primary technical risks of implementing these security fixes?**: *Identify potential breaking changes, performance impacts, or integration challenges.*
- **What are the business continuity risks during and after implementation?**: *Note any risks to ongoing operations, user access, or data availability.*
- **What rollback strategy should be in place if issues arise?**: *Define how changes can be safely reverted if security fixes cause unexpected problems.*

**MINIMAL CHANGE CLAUSE & SECURITY DISCIPLINE GUIDELINES** *(Recommended for most Security Fixes)*

- **IMPORTANT: Make only the changes that are absolutely necessary to remediate the identified security vulnerabilities.**
    - Focus specifically on addressing the security gaps without modifying unrelated code. Your goal is to eliminate vulnerabilities while preserving current functionality and minimizing the risk of introducing new issues.
- **IMPORTANT: Follow these Security Discipline Guidelines to ensure safe vulnerability remediation:**
    - Make only the minimal necessary changes to address each specific vulnerability
    - Preserve existing functionality and user workflows exactly as-is
    - Do not modify code that is not directly related to the security vulnerabilities
    - Do not enhance or optimize code beyond what is required for security remediation
    - Implement security controls using the least invasive approach possible
    - Document all security-related changes with clear comments explaining the threat addressed
    - When multiple security solutions exist, choose the one that requires the least modification to existing code
    - If you identify additional security concerns beyond the scope, note them but do not fix unless specified