# Remediation ticket

**Title:** <one line a developer can act on, not the scanner's string>
**Asset:** <system / repo / image>
**Owner:** <the team or person who can actually fix it>
**Priority:** <P1 / P2 / P3 / P4 from triage>
**Due:** <date, from the SLA table: P1 3d, P2 14d, P3 30d, P4 90d>

## What is wrong
<plain language. what the finding is, on which asset.>

## Why it matters here
<the context that set the priority: exposure, asset criticality, KEV. not the CVSS alone.>

## How to fix it
<the specific action. version to upgrade to, config to change, code to patch.>

## How we will verify
<the exact check that proves it is fixed: a re-scan, a curl, a config read. trust but verify.>

## Evidence
<link to the finding, the scan, the proof of fix.>