Remediation

Every finding carries a remediation block tailored to the stack Pentestas fingerprinted. Not generic OWASP advice — specific, paste-ready guidance for the framework you're actually running.

Shape of a remediation

Three parts:

1. One-line fix

The shortest possible action that resolves the finding. E.g. for a missing X-Frame-Options:

Set X-Frame-Options: DENY on all HTML responses, or use the stricter frame-ancestors CSP directive.

2. Stack-specific code

The exact change for your framework. Pentestas ships templates for:

Rails — config/application.rb middleware hints
Django — MIDDLEWARE + SECURE_* settings
Flask / FastAPI — middleware decorators
Express / Koa — helmet config
ASP.NET Core — app.UseSecurityHeaders() + middleware registrations
Laravel / Symfony — security.yaml snippets
Go (std + echo/gin) — middleware
Cloudflare Workers / nginx / Apache — config snippets for edge-layer enforcement

For CWE-defined vulns (SQLi, XSS, SSRF, etc.), the block shows the vulnerable code pattern + safe rewrite, using the language Pentestas detected.

3. Defence-in-depth

Optional hardening beyond the minimum fix. E.g. for an XSS finding:

Minimum: escape user input in this template.
DiD #1: set a strict CSP that rejects inline scripts.
DiD #2: apply trusted-types at the DOM layer.
DiD #3: add the fix to your lint config so future regressions fail CI.

AI remediation (Pro+)

Claude re-reads the finding and proposes remediation tuned to your exact codebase. When the app's source is accessible (via GitHub integration), the AI layer can reference specific files and methods; otherwise it works from the HTTP trace.

Output is a markdown block with reasoning + code change + verification command.

Copy-paste workflow

Open finding → Remediation tab.
Click Copy fix to grab the code snippet.
Paste into your PR + link back to the finding for reviewers.

Verification

After deploying the fix, Rerun scan on the same target. The Accuracy Gate re-tests the previously-failing payload; if it now fails cleanly, the finding is marked Resolved with the rescan timestamp. This creates a clean audit trail: Found → Fix → Verified.

When the fix isn't obvious

Some findings (business-logic, authorization model mistakes) don't have a code-level one-liner. For these, the remediation is a design recommendation:

"Refactor the /api/users/{id}/orders endpoint to derive user_id from the session, not from the path. Current implementation trusts the path parameter, which is the root cause of this IDOR."

Enterprise customers can engage Pentestas Professional Services for engineer-led remediation pairing sessions — we walk the fix with your team for one-hour sessions.