Use cases / When someone needs an answer
A critical advisory landed. Are we affected?
A critical advisory lands, a search of one build file has already marked billing "not affected", and a customer needs an answer this week.
Jigward checks what each repository resolves and whether the risky feature is used, records an answer per repository with what it could not confirm, and leaves a tested draft fix for the one reachable case. What goes to the customer stays with the security engineer.
The film
Chapters
Read the narration
0:00 A critical advisory and a guess
A critical advisory just landed. The spreadsheet already calls billing safe, from one build file. And David owes a customer an answer by Friday. I'm Jigward. Nina's mention makes this my task. I can read all four repositories. Any fix I make goes up as a draft for review.
0:22 What each repository really resolves
The advisory is specific: versions below the patch, and only where class typing reads untrusted input. Billing's build file never names the library. The resolved tree does, through a reporting library. The API has the patch. Platform has the affected version. Storefront only declares a range, so I can't confirm what's installed.
0:49 Is it reachable?
Is it reachable? In billing, yes: partner uploads are decoded with class typing on. Nothing similar in platform or storefront. I record it in a security ticket, so David's answer rests on evidence, not on a spreadsheet. Four repositories, four different answers.
1:13 A tested draft fix
Billing is the one reachable case, so it gets the fix. I pin the patched version, prove the build uses it, and run the tests. The fix goes up as a draft PR. Class typing on partner uploads stays on. Turning it off is the billing team's design call.
1:34 The answer, and what's still open
So, are we affected? Yes, in billing, until the fix is deployed. Storefront stays an open question until someone checks its build. What goes to the customer is Nina's call.
What changes
Today. An engineer searches a build file and fills in a spreadsheet row. A build-file search misses a library that arrives through another one, a declared version range does not say what is installed, and a version match from a scanner or a search says nothing about whether the code uses the feature the advisory names. The row marked "not affected" rarely records how anyone knew.
-
Before: "Not affected" in a spreadsheet, after a search of one build file.
With Jigward: The library found where it hides, in billing's resolved tree, through a reporting library.
-
Before: A version match read as exposure, or its absence read as safety.
With Jigward: Four repositories, four answers. Affected and reachable, an affected version with no risky call found, patched, and not confirmed.
-
Before: An answer for the customer that nobody can trace back.
With Jigward: A security ticket that records each answer and what it rests on, and a tested draft fix for the one reachable case.
What Jigward does
@Jigward are we affected? For every repository, the resolved version and whether class typing is used. Security ticket as usual for a critical advisory. Flag what you can't confirm.
Connected beforehand
- #security is named for the Context that holds the four repositories.
- The four repositories are connected through GitHub, and their dependency trees are part of Jigward's project knowledge.
- The security project in Jira is named with the same Context.
-
Reads the advisory
Two facts decide it. Versions below the patch are affected, and only where class typing reads untrusted input.
-
Checks what each repository resolves
Billing's build file never names the library, but its resolved tree has an affected version, through a reporting library. The API has the patch and platform has an affected version. Storefront only declares a range, so its installed version cannot be confirmed.
-
Looks for the risky feature
A code search finds one call in billing, where partner uploads are decoded with class typing on. No such call turns up in platform or storefront.
-
Records the matrix
A security ticket in Jira holds the answer for each repository and what it rests on, including the one Jigward could not confirm.
-
Fixes the reachable case
In billing, a Gradle constraint pins the patched version. The build now resolves it and the tests pass. Class typing stays on, because turning it off is the billing team's design call.
-
Answers in the thread
It opens a draft pull request and answers in the thread: treat billing as exposed until the fix is deployed, storefront is still open, and here is what was not checked.
Jigward in this case
-
Slack
The question arrives as a mention in #security, becomes a Task, and the answer goes back to its thread.
-
Project knowledge
Each repository's captured dependency tree shows the version it resolves. In billing that includes a library that arrives through another; for storefront it holds only the declared range.
-
GitHub
A code search looks for class typing in every repository, and the billing fix goes up as a draft pull request. Jigward never merges.
-
Jira
Jigward creates the security ticket with the matrix and what each row rests on.
-
Workspace
The constraint, the build that resolves the patched version and the test run happen on Jigward's own copy of the billing repository.
What comes back, and what stays with the team
What comes back
- #security in Slack The answer per repository, the interim stance, what was not checked, and links to the ticket, the draft pull request and the Task.
- Jira A security ticket with the matrix, what each row rests on and what is still open.
- GitHub A draft pull request for billing with the resolved version, the call site, the constraint and the test run.
What the team decides
- What goes to the customer. The matrix is a first pass, not a security statement, and the security engineer chose to confirm storefront's build first.
- Merging and deploying the billing fix, and whether to turn off class typing for partner uploads. Jigward merges and deploys nothing.
- Upgrading platform, left for a separate Task.
What Jigward did not check
- Deployed builds and container images.
- Storefront's installed version and the packages it pulls in.
- Reachability at runtime, beyond the code Jigward read.
- How the reporting library behaves on the patched version, beyond billing's tests.
Meet your next engineering coworker
Bring a question
from your own project.
See how Jigward can help your team understand the system and move the next task forward.
Jigward is in closed testing. Accounts are created by hand; sending a request does not create one.