Security retesting: what to check after a fix

Agree a small verification plan

Record the finding reference, target environment and deployed version. Ask the maintainer to explain the intended behavior before testing. This prevents a closed ticket from becoming the only evidence that the problem was resolved.

Check nearby legitimate workflows

If a permission change blocks a risky action, confirm that the correct user can still complete the intended task. If attachment access changed, include the approved support workflow. Keep the retest inside the original authorization or agree an updated scope.

Keep useful evidence without excess data

Save the outcome, date and relevant reference, with sensitive values removed. OWASP logging guidance supports excluding secrets and unnecessary sensitive information from logs. A verification note should be useful to the next maintainer without becoming another data exposure.

Practical checklist

• Identify the deployed fix.
• Check the original condition.
• Check an allowed business action.
• Record a redacted verification result.

A common question

Is a new deployment enough to close the finding?

Not by itself. Confirm that the intended fix is present in the relevant environment and record the verification outcome.