---
title: "Fix each finding within the time its · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/fix-deadlines
id: SEC-107
level: Recommended
updated: 2026-10-22
tokens: 1517
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Fix each finding within the time its severity allows

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Rules of engagement](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: SEC-107
- Level: Recommended
- Chapter: [Rules of engagement](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement.md)
- Rule: Triage every reported vulnerability within 2 working days. Fix a critical one within 7 days, high within 30, medium within 90 and low within 180, or record a dated risk acceptance.
- Check: A daily job reads every open issue labelled security. Each has a severity, an owner and a due date that matches the table. The job fails on an issue past its due date without a risk register entry, or untriaged after 2 working days.
- How: Count from the moment a person, a scanner or a researcher reports it. Triage means reproduce it, rank it as [rank findings by harm](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/rank-findings.md) says and name one owner. A hole that attackers already use, or that is on a known-exploited list such as CISA KEV, counts as critical. In a product under the Cyber Resilience Act it also starts the 24-hour clock in [report exploited vulnerabilities](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-vulnerability-reporting.md). Keep the severity, owner and due date in the issue tracker, where a job can read them. A finding that cannot be fixed in time goes into the [risk register](https://agentwranglers.se/playbook/compliance/controls-and-evidence/risk-register.md) with a workaround and a new date. Updates to software you run follow the shorter limits in [keep software current and quiet](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/patch-and-hide-versions.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const FIX_DAYS = { critical: 7, high: 30, medium: 90, low: 180 };
const DAY_MS = 86_400_000;

export const dueDate = (reportedAt, severity, isKnownExploited) =>
  new Date(new Date(reportedAt).getTime() + FIX_DAYS[isKnownExploited ? 'critical' : severity] * DAY_MS);

export const overdue = (issues, now = new Date()) =>
  issues.filter(issue => !issue.riskAccepted && dueDate(issue.reportedAt, issue.severity, issue.knownExploited) < now);
```

### Python example

```python
from datetime import datetime, timedelta

FIX_DAYS = {"critical": 7, "high": 30, "medium": 90, "low": 180}

def due_date(reported_at: datetime, severity: str, is_known_exploited: bool) -> datetime:
    return reported_at + timedelta(days=FIX_DAYS["critical" if is_known_exploited else severity])

def overdue(issues: list[dict], now: datetime) -> list[dict]:
    return [i for i in issues
            if not i.get("risk_accepted") and due_date(i["reported_at"], i["severity"], i["known_exploited"]) < now]
```

## Sources

- [FIRST CVSS v4.0 Specification](https://www.first.org/cvss/v4.0/specification-document)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Related rules

- SEC-6 [Rank findings by harm](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/rank-findings.md) in Adversarial testing
- CMP-49 [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-vulnerability-reporting.md) in Compliance and governance
- CMP-39 [Keep a risk register with treatment dates](https://agentwranglers.se/playbook/compliance/controls-and-evidence/risk-register.md) in Compliance and governance
- SEC-70 [Keep software current and quiet](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/patch-and-hide-versions.md) in Adversarial testing
- CMP-73 [Publish an advisory for every fixed vulnerability](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/security-advisories.md) in Compliance and governance
- IOT-37 [Make every report and advisory name the model and firmware version](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/model-and-version.md) in Connected devices
- OSS-22 [Send private reports to at least two people](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/security-contacts.md) in Open source maintenance
- OSS-24 [Agree the publication date with the reporter](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/coordinated-disclosure.md) in Open source maintenance
- OSS-28 [Publish a cybersecurity policy as an open source steward](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/steward-security-policy.md) in Open source maintenance
- OSS-35 [Answer every new issue and pull request within a set time](https://agentwranglers.se/playbook/open-source/issues-and-triage/first-response-time.md) in Open source maintenance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/fix-deadlines">Agent Wranglers adversarial testing playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Rank findings by harm](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/rank-findings.md)
- Next: [Turn every fix into a check](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/fix-becomes-check.md)
- [Rules of engagement](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement.md)