---
title: "Fix each finding within the time its · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/fix-deadlines
id: APS-81
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1656
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Fix each finding within the time its severity allows

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Errors, logs and vulnerabilities](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-81
- Level: Recommended
- Chapter: [Errors, logs and vulnerabilities](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities.md)
- Rule: Triage every reported vulnerability within 2 working days. Fix a critical one within 7 days, high within 30, medium within 90 and low within 180, or record a dated risk acceptance.
- Check: A daily job reads every open issue labelled security. Each has a severity, an owner and a due date that matches the table. The job fails on an issue past its due date without a risk register entry, or untriaged after 2 working days.
- How: Count from the moment a person, a scanner or a researcher reports it. Triage means reproduce it, rank it as [rank findings by harm](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/rank-findings.md) says and name one owner. A hole that attackers already use, or that is on a known-exploited list such as CISA KEV, counts as critical. In a product under the Cyber Resilience Act, an actively exploited hole also starts the 24-hour early warning in [report exploited vulnerabilities](https://agentwranglers.se/playbook/compliance/security-laws/cra-vulnerability-reporting.md). Keep the severity, owner and due date in the issue tracker, where a job can read them. A finding that cannot be fixed in time goes into the [risk register](https://agentwranglers.se/playbook/compliance/controls-and-evidence/risk-register.md) with a workaround and a new date. This is the one home of these deadlines. Security updates to software you run follow them too, as [keep software current and quiet](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/patch-and-hide-versions.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const FIX_DAYS = { critical: 7, high: 30, medium: 90, low: 180 };
const DAY_MS = 86_400_000;

export const dueDate = (reportedAt, severity, isKnownExploited) =>
  new Date(new Date(reportedAt).getTime() + FIX_DAYS[isKnownExploited ? 'critical' : severity] * DAY_MS);

export const overdue = (issues, now = new Date()) =>
  issues.filter(issue => !issue.riskAccepted && dueDate(issue.reportedAt, issue.severity, issue.knownExploited) < now);
```

### Python example

```python
from datetime import datetime, timedelta

FIX_DAYS = {"critical": 7, "high": 30, "medium": 90, "low": 180}

def due_date(reported_at: datetime, severity: str, is_known_exploited: bool) -> datetime:
    return reported_at + timedelta(days=FIX_DAYS["critical" if is_known_exploited else severity])

def overdue(issues: list[dict], now: datetime) -> list[dict]:
    return [i for i in issues
            if not i.get("risk_accepted") and due_date(i["reported_at"], i["severity"], i["known_exploited"]) < now]
```

## Sources

- [FIRST CVSS v4.0 Specification](https://www.first.org/cvss/v4.0/specification-document)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Related rules

- SEC-6 [Rank findings by harm](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/rank-findings.md) in Adversarial testing
- CMP-73 [Publish an advisory for every fixed vulnerability](https://agentwranglers.se/playbook/compliance/security-laws/security-advisories.md) in Compliance and governance
- IOT-37 [Make every report and advisory name the model and firmware version](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/model-and-version.md) in Connected devices
- OSS-22 [Send private reports to at least two people](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/security-contacts.md) in Open source maintenance
- OSS-24 [Agree the publication date with the reporter](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/coordinated-disclosure.md) in Open source maintenance
- OSS-28 [Publish a cybersecurity policy as an open source steward](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/steward-security-policy.md) in Open source maintenance
- OSS-35 [Answer every new issue and pull request within a set time](https://agentwranglers.se/playbook/open-source/issues-and-triage/first-response-time.md) in Open source maintenance
- APS-67 [Keep software current and quiet](https://agentwranglers.se/playbook/application-security/secrets-and-configuration/patch-and-hide-versions.md) in Application security
- APS-106 [Say which known holes do not affect you with VEX](https://agentwranglers.se/playbook/application-security/supply-chain/vex.md) in Application security
- CMP-49 [Report exploited vulnerabilities in your products](https://agentwranglers.se/playbook/compliance/security-laws/cra-vulnerability-reporting.md) in Compliance and governance
- CMP-39 [Keep a risk register with treatment dates](https://agentwranglers.se/playbook/compliance/controls-and-evidence/risk-register.md) in Compliance and governance
- APS-107 [Publish a vulnerability disclosure policy](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/disclosure-policy.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/fix-deadlines">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Log attacks without personal data](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/security-logging.md)
- Next: [Publish a vulnerability disclosure policy](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities/disclosure-policy.md)
- [Errors, logs and vulnerabilities](https://agentwranglers.se/playbook/application-security/errors-logs-and-vulnerabilities.md)