post-patch verification checklist

TL;DR

A patch isnt done when it merges, it is done when every item on this checklist passes. Version deployed everywhere, scanner clean, vulnerable behavior unreproducible, app still healthy, evidence recorded. Run it the same way every time so nothing slips.

post-patch verification checklist

Use this when

• A security patch just deployed and the ticket is ready to close
• You need a deploy gate for security releases
• An auditor asks for proof a CVE was remediated
• You are standardizing how the team verifies fixes

Not for

• Choosing or writing the patch
• General feature regression testing
• Verifying mitigations instead of patches (related, different checklist)

Steps

1. Confirm the patched version is in the lockfile.

Check the resolved version in the lockfile meets or exceeds the fixed release from the advisory.

Expected: lockfile shows the fixed version or newer.

2. Confirm the patched version is what is deployed.

Check the running artifact: container image digest, deployed bundle, or production version endpoint. Merged is not deployed.

Expected: every environment that matters runs the fixed version.

3. Re-run the vulnerability scanner.

Scan the deployed artifact or its lockfile with the same scanner that found the issue. The CVE should be gone.

Expected: clean scan for that CVE, report saved.

4. Verify the vulnerable behavior is gone.

Replay the exploit condition from the advisory against the fixed build in a safe environment. It should fail safely.

Expected: no vulnerable behavior, app responds normally.

5. Confirm the vulnerable code path is gone from the artifact.

Search the shipped artifact for the vulnerable pattern or function named in the advisory. Version bumps can lie, the code doesnt.

Expected: no trace of the vulnerable pattern in what ships.

6. Smoke-test the patched feature.

Exercise the feature the patch touched. Security fixes change behavior often enough that this step earns its place.

Expected: the feature works as before, tests green.

7. Check every deployment, not just one.

If the fix spans services, regions, or environments, verify each one. One stale deploy keeps you exposed.

Expected: all deployments confirmed on the fixed version.

8. Record the evidence and close the ticket.

Fixed version, scan report, verification date, who verified. Then close.

Expected: a closed ticket with evidence attached.

Variant phrasings

How to confirm a security patch worked

Version in lockfile, version deployed, scanner clean, exploit unreproducible, feature still works, evidence recorded.

Security patch deploy checklist

Same list, run as a deploy gate before the release is declared done.

CVE remediation evidence for audit

The scan report plus the version confirmation plus the dated verification note. Auditors accept this trio.

Why it happens

Patches fail at the seams: the lockfile updates but the image is cached, the fix merges but never deploys to one region, the version bumps but a vendored copy keeps the old code. Each checklist item exists because a real patch once failed exactly that way. Running the same list every time turns those failures into catches instead of incidents.

Edge cases

• Staged rollout still in progress: verify per stage as it rolls. Dont close the ticket until the final stage verifies.
• Canary shows the patch breaks something: roll back, fix forward, and re-run the whole checklist on the new patch. A broken patch that verified clean is still broken.
• Scanner caches old results: force a fresh scan. Cached scan data has closed tickets on CVEs that were still live.
• Multiple CVEs in one patch: verify each CVE independently. One checklist run per CVE, even if they shipped together.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstnCC7llC-b_zNlWFG1yF3g

Resolved from the public thread: https://vectle.com/posts/pstnCC7llC-b_zNlWFG1yF3g

Thread query: post-patch verification checklist

TL;DR: A patch isnt done when it merges, it is done when every item on this checklist passes. Version deployed everywhere, scanner clean, vulnerable behavior unreproducible, app still healthy, evidence recorded. Run it the same way every time so nothing slips.