# Demonic Binary — Remediation & Retest Acceptance Worksheet

**Template status: DRAFT / ILLUSTRATIVE / NOT A COMPLETED ASSESSMENT**

Use after an authorized review to connect a confirmed finding to an approved engineering
change, regression test and bounded retest. This worksheet is not evidence that a customer
engagement or remediation has occurred.

## 1. Finding record
- Finding ID / title: [reference]
- Source report and approved evidence location: [reference without sensitive data]
- Affected application, component, asset and version: [document]
- Authorized original test conditions: [document]
- Observed behavior and exploitability confidence: [document]
- Business impact and agreed prioritization: [document]
- Technical owner and decision owner: [document]

## 2. Remediation decision
- Correction / server enforcement point: [description]
- Code repository and change request ID: [internal reference]
- Implementation approval and scope: [record decision]
- Reviewer and required deployment checks: [record]
- Regression tests for both unauthorized and legitimate operations: [list]
- Rollback trigger and rollback owner: [record]
- Dependency and release constraints: [record]
- Implementation excluded or declined: [record explicitly, if applicable]

## 3. Acceptance test matrix
| Test ID | Precondition / identity | Expected result | Observed result | Evidence | Status |
| --- | --- | --- | --- | --- | --- |
| RT-01 | [Original unauthorized actor/action] | Denied by server | [capture] | [safe ref] | [Pending/Pass/Fail] |
| RT-02 | [Authorized actor/action] | Allowed | [capture] | [safe ref] | [Pending/Pass/Fail] |
| RT-03 | [Expired/revoked session] | Denied | [capture] | [safe ref] | [Pending/Pass/Fail] |
| RT-04 | [Retry/replay/duplicate request] | Safe and idempotent | [capture] | [safe ref] | [Pending/Pass/Fail] |

Use only approved test identities and synthetic or sanitized test data.

## 4. Retest execution
- Retest expressly included in agreement? [Yes/No; reference]
- Authorized retest window, environment and tested release: [document]
- Testing performed by / reviewer: [document]
- Original reproduction repeated? [Yes/No and outcome]
- Relevant regression test results: [attach approved evidence]
- Unchanged systems or paths not covered: [list]
- Evidence storage and retention requirements: [document]

## 5. Closure and ownership
- Status: [Unverified / Resolved in tested scope / Partially remediated / Open / Accepted risk]
- Residual risks, failed checks and out-of-scope assets: [document]
- Client security acceptance owner and date: [document]
- Engineering release/rollback owner and date: [document]
- Follow-up action, priority, owner, due date: [document]
- Handoff acknowledgment: [document]

A passing retest establishes only what was actually exercised in the agreed scope;
it does not prove that the entire product is secure or vulnerability-free.

**No test or result in this worksheet is a real customer claim until completed and approved.**
Related: https://demonicbinary.com/security/find-fix-verify