AI Vulnerability Remediation Recipes

Browse reviewed workflows for common security tasks. Search by intent, filter by outcome and review quality, share a filtered URL, or retrieve the same bounded context through JSON and MCP.

Human-reviewed · agent-ready

Turn a finding into bounded, reviewable work.

Choose the smallest recipe that matches the outcome you need. Every workflow is structured for people to inspect and agents to retrieve, with explicit inputs, guardrails, evidence, and stop conditions.

Connect through MCP Open CVE Database

Curated workflows: 155
High completeness: 155
Model-attributed: 155
Outcome lanes: 5

JavaScript is required for in-page filtering. The first curated results remain available below, and the full feed is available at /api/curated-recipes.json.

Curated collection

Browse by outcome

Start with intent, then refine by severity, outcome, and review quality. CVE-linked workflows also appear inside matching CVE records.

Refine resultsSeverityOutcomeReview quality

Agent and data access

Retrieve the same curated workflows as structured JSON or through read-only MCP tools.

/api/curated-recipes.json/mcp

Showing 18 of 155 curated recipes.

Dense list view

Code Hygienedevelopmentcomplete 100

.NET async cancellation and fire-and-forget lifecycle

.NET async cancellation and fire-and-forget lifecycle: Propagate CancellationToken and observe every Task failure.

code hygiene
audit
remediation

code-hygiene.dotnet.dotnet-async-cancellation-and-fire-and-forgetdotnet/nugetTested withgpt-5-codex

Open

Code Hygienedevelopmentcomplete 100

.NET disposable and async-disposable lifecycle

.NET disposable and async-disposable lifecycle: Dispose synchronous and asynchronous resources exactly once after their final use.

code hygiene
audit
remediation

code-hygiene.dotnet.dotnet-disposable-and-async-disposable-lifecycledotnet/nugetTested withgpt-5-codex

Open

Code Hygienedevelopmentcomplete 100

.NET LINQ enumeration and EF query boundaries

.NET LINQ enumeration and EF query boundaries: Avoid repeated enumeration, client evaluation, N+1 loading, and leaked query lifetimes.

code hygiene
audit
remediation

code-hygiene.dotnet.dotnet-linq-enumeration-and-ef-query-boundariesdotnet/nugetTested withgpt-5-codex

Open

Code Hygienedevelopmentcomplete 100

.NET nullable and analyzer suppression debt

.NET nullable and analyzer suppression debt: Resolve nullable and analyzer warnings without null-forgiving or pragma expansion.

code hygiene
audit
remediation

code-hygiene.dotnet.dotnet-nullable-and-analyzer-suppression-debtdotnet/nugetTested withgpt-5-codex

Open

Code Hygienedevelopmentcomplete 100

C and C++ atomic, lock, and thread lifecycle

C and C++ atomic, lock, and thread lifecycle: Remove data races, lock-order hazards, and detached thread lifetimes.

code hygiene
audit
remediation

code-hygiene.c-cpp.c-cpp-atomic-lock-and-thread-lifecyclec-cpp/cmakeTested withgpt-5-codex

Open

Code Hygienedevelopmentcomplete 100

C and C++ bounds, integer, and undefined-behavior hygiene

C and C++ bounds, integer, and undefined-behavior hygiene: Remove unchecked bounds, lossy arithmetic, lifetime, and undefined-behavior hazards.

code hygiene
audit
remediation

code-hygiene.c-cpp.c-cpp-bounds-integer-and-undefined-behaviorc-cpp/cmakeTested withgpt-5-codex

Open

Code Hygienedevelopmentcomplete 100

C and C++ compiler warning and suppression debt

C and C++ compiler warning and suppression debt: Resolve portable compiler diagnostics without blanket flags or pragmas.

code hygiene
audit
remediation

code-hygiene.c-cpp.c-cpp-compiler-warning-and-suppression-debtc-cpp/cmakeTested withgpt-5-codex

Open

Code Hygienedevelopmentcomplete 100

C and C++ const, span, view, and lifetime hygiene

C and C++ const, span, view, and lifetime hygiene: Make mutation and non-owning view lifetimes explicit.

code hygiene
audit
remediation

code-hygiene.c-cpp.c-cpp-const-span-view-and-lifetime-hygienec-cpp/cmakeTested withgpt-5-codex

Open

Code Hygienedevelopmentcomplete 100

C and C++ ownership, RAII, and resource lifecycle

C and C++ ownership, RAII, and resource lifecycle: Make memory, file, socket, lock, and handle ownership explicit.

code hygiene
audit
remediation

code-hygiene.c-cpp.c-cpp-ownership-raii-and-resource-lifecyclec-cpp/cmakeTested withgpt-5-codex

Open

Code Hygienedevelopmentcomplete 100

CI workflow timeout, concurrency, and cache hygiene

CI workflow timeout, concurrency, and cache hygiene: Bound CI jobs and prevent stale caches and duplicate workflow races.

code hygiene
audit
remediation

code-hygiene.platform.ci-workflow-timeout-concurrency-and-cache-hygieneci/workflowsTested withgpt-5-codex

Open

Complianceinfocomplete 100

CIS Controls v8.1 Safeguard Implementation Evidence Check

Assess CIS Controls v8.1 evidence readiness: verify applicability, map official requirements to artifacts, record gaps, and plan remediation.

audit
compliance
risk

CIS Controls v8.1Tested withgpt-5-codex

Open

Complianceinfocomplete 95

CISA Cross-Sector Cybersecurity Performance Goals Evidence Check

Assess CISA Cross-Sector CPGs evidence readiness: verify applicability, map official requirements to artifacts, record gaps, and plan remediation.

audit
compliance

CISA Cross-Sector CPGsTested withgpt-5-codex

Open

Complianceinfocomplete 95

CJIS Security Policy v6.1 Evidence Check

Assess CJIS Security Policy v6.1 evidence readiness: verify applicability, map official requirements to artifacts, record gaps, and plan remediation.

audit
compliance

CJIS Security Policy v6.1Tested withgpt-5-codex

Open

Complianceinfocomplete 95

CMMC 2.0 Evidence Readiness Check

Assess CMMC 2.0 evidence readiness: verify applicability, map official requirements to artifacts, record gaps, and plan remediation.

audit
compliance

CMMC 2.0Tested withgpt-5-codex

Open

Complianceinfocomplete 100

COBIT 2019 Governance System Evidence Check

Assess COBIT 2019 evidence readiness: verify applicability, map official requirements to artifacts, record gaps, and plan remediation.

audit
compliance
risk

COBIT 2019Tested withgpt-5-codex

Open

Code Hygienedevelopmentcomplete 100

Complexity and long-function reduction

Complexity and long-function reduction: Reduce hard-to-review control flow without changing behavior. Includes scoped detection, verification, and stop conditions.

code hygiene
audit
remediation

code-hygiene.cross-language.complexity-and-long-function-reductionmulti-languageTested withgpt-5-codex

Open

Code Hygienedevelopmentcomplete 100

Configuration validation and default hygiene

Configuration validation and default hygiene: Make invalid configuration fail clearly and defaults behave consistently.

code hygiene
audit
remediation

code-hygiene.cross-language.configuration-validation-and-default-hygienemulti-languageTested withgpt-5-codex

Open

Code Hygienedevelopmentcomplete 100

Container signal, healthcheck, and shutdown hygiene

Container signal, healthcheck, and shutdown hygiene: Make PID 1 signal handling, readiness, health, and graceful shutdown correct.

code hygiene
audit
remediation

code-hygiene.platform.container-signal-healthcheck-and-shutdowncontainers/ociTested withgpt-5-codex

Open

Use recipes safely

Recipes guide people and agents; they do not enforce policy.

Match the recipe to one finding or evidence question.
Read its inputs, scope, guardrails, and stop conditions before acting.
Adapt repository-specific build, test, branch, and ownership details.
Start with a small change, verify the output contract, and require human review.

Back recipes with scoped credentials, branch protections, CODEOWNERS, and required CI. Never treat generated remediation as proof that a system is safe.

For agents and integrations

Use the curated JSON feed for workflow discovery. For exact or filtered vulnerability intelligence, use the separate CVE Database and its dedicated MCP tools. MCP access should remain read-only unless the task explicitly authorizes a specific write.

Use approved MCP servers as read-only evidence.
Do not create tickets, push branches, rotate secrets, deploy changes, or alter
cloud resources through MCP unless this task explicitly grants that permission.

Maintainers can run recipes_quality_report through MCP to find recipes that need stronger inputs, when-to-use guidance, output contracts, verification, or guardrails. Those same headings also drive search quality on this site.

Contribute

Contributions can add workflows, evidence checks, toolsets, templates, or reviewed CVE overrides. Remove secrets, internal hostnames, customer data, and private vulnerability details first, then follow the contribution process.