> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blitzy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fix Security Vulnerabilities

> Address security vulnerabilities, implement security best practices, and remediate CVEs using AI-Native code generation

Security debt is uniquely dangerous: every unpatched CVE and every hardcoded secret is an open door. Yet remediation work is tedious, high-stakes, and perpetually deprioritized against feature deadlines. Blitzy lets teams burn through security backlogs in days instead of quarters, implementing secure coding patterns across the codebase, addressing OWASP Top 10 vulnerabilities, and maintaining compliance standards throughout.

<Card title="Ready to fix security vulnerabilities?" icon="rocket" href="/templates/code-quality-maintenance/fix-security-vulnerabilities">
  Use the **Fix Security Vulnerabilities Template** to get started with a structured prompt
</Card>

<Note>
  **Jump to:** [When to Use](#when-to-use-this-approach) | [Prompt Structure](#prompt-structure) | [Key Considerations](#key-considerations) | [Common Patterns](#common-patterns) | [Troubleshooting](#troubleshooting)
</Note>

## When to Use This Approach

<Tabs>
  <Tab title="CVE Remediation">
    Patch known vulnerabilities in your dependencies or application code before they become incidents.
  </Tab>

  <Tab title="Auth and Access Hardening">
    Upgrade authentication to OAuth 2.0, fix permission bypasses, and implement proper RBAC controls.
  </Tab>

  <Tab title="Secret Management">
    Eliminate hardcoded credentials and migrate to runtime secret resolution from secure storage.
  </Tab>

  <Tab title="Compliance Readiness">
    Meet SOC 2, PCI-DSS, HIPAA, and other framework requirements with documented security controls.
  </Tab>
</Tabs>

## Prompt Structure

Follow the [Golden Rules](/prompt-engineering/golden-rules) when writing your security fix prompt. Focus especially on:

* **CVE References** - Cite specific CVE numbers or CWE categories being addressed
* **Attack Vectors** - Document how the vulnerability can be exploited with examples
* **Security Standards** - Reference OWASP, NIST, or industry standards to follow
* **Secret Management** - Use placeholder pattern (`${SECRET_NAME}`) for all credentials

## Key Considerations

<CardGroup cols={2}>
  <Card title="Secret Management Is Non-Negotiable" icon="key">
    Never include actual credentials in prompts. Always use placeholder patterns (`${SECRET_NAME}`) and implement runtime resolution from secure storage (Google Secret Manager, AWS Secrets Manager).
  </Card>

  <Card title="Defense in Depth Over Single Controls" icon="layer-group">
    Implement multiple security layers (network security, application security, data security). Single control failures should not compromise the entire system.
  </Card>

  <Card title="Security Testing Validates Fixes" icon="vial-circle-check">
    Automated security scanners (SAST, DAST) must confirm vulnerability remediation. Manual penetration testing validates scanner results and catches edge cases.
  </Card>

  <Card title="Compliance Documentation Tracks Controls" icon="clipboard-check">
    Security fixes for regulated environments require documentation showing which controls address specific compliance requirements (SOC 2, PCI-DSS, HIPAA).
  </Card>
</CardGroup>

## Common Patterns

**SQL injection remediation** - Replace string concatenation with parameterized queries, escape LIKE wildcards, add input validation, and implement query logging without exposing sensitive parameters.

**OAuth 2.0 implementation** - Replace basic auth with token-based authentication, validate token signatures and expiration, implement scope-based authorization, and store OAuth secrets in secure storage.

**Hardcoded secrets elimination** - Scan codebase for credentials, migrate to placeholder pattern (`${SECRET_NAME}`), implement runtime secret resolution from Secret Manager, and add masked logging to prevent secret exposure.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Security scanners still report vulnerabilities">
    Vulnerability may not be fully remediated. Re-run scanners with verbose output, review CVE remediation guidance, and add the [Catalog Security Vulnerabilities](/templates/rules/catalog-security-vulnerabilities) rule to your project on the platform for comprehensive coverage.
  </Accordion>

  <Accordion title="Secrets still appear in logs or errors">
    Logging may not be fully masked. Implement custom log formatters that pattern-match sensitive data (tokens, keys, passwords), ensure error messages truncate or redact secrets, and review all log output.
  </Accordion>

  <Accordion title="Authentication still vulnerable after OAuth implementation">
    Token validation may be incomplete. Verify signature validation, expiration checks, issuer validation, and scope enforcement. Add tests for token manipulation attempts.
  </Accordion>

  <Accordion title="Compliance audit fails after security fixes">
    Documentation may be incomplete. Map each security control to specific compliance requirements, update security documentation with implementation details, and provide audit trail of security changes.
  </Accordion>

  <Accordion title="Performance degrades after security implementation">
    Security controls may be inefficient. Profile authentication/authorization paths, implement caching for token validation, optimize encryption operations, and add the [Analyze Performance Impact](/templates/rules/analyze-performance-impact) rule to your project on the platform.
  </Accordion>
</AccordionGroup>