A pentester once told me my patch notes were useless, and he was right

I used to write patch notes like 'fixed SQL injection in login' and call it a day. Last March, a pentester friend reviewed one of my updates and said, 'This tells me nothing. Did you close the P1 vector or just the one someone found?' That hit hard. Now I list the exact endpoint, the input field, the payload type, and whether I added a WAF rule or changed the query logic. I also include the CVSS score before and after. It feels like a pain at first, but it's saved me twice when reverts happened and I had to explain what actually broke. Has anyone else gotten feedback that made them over-document everything, or am I the only one who used to half-ass the notes?

1 comments

1 Comment

eric_morgan5915d ago

Read somewhere that good notes are really just future-you saying thanks.