Write a security fix commit that doesn't reveal the bug

About this exercise

Write the commit message for this security fix. Your repo is public and the advisory isn't out yet, so policy says: subject 'fix(security): ' plus a neutral summary under 50 characters, then only two trailer lines, 'Ref: SEC-212' and 'Reviewed-by: Dana Ito', with no body text and nothing that hints at how to trigger the bug. Put it in exactly 1 code block of at most 3 non-empty lines, with under 10 words outside it.

Common mistakes when you ask AI for this

• Describing the bug. The AI writes a helpful message like 'fix path traversal via ../' that tells attackers what to try. Try: Say: "Public repo, advisory not out: nothing about how to trigger the bug."
• Wrong prefix or reference. The AI picks its own style, like 'Security: fix download bug (#212)'. Try: Give the shape: "fix(security): <summary>, then Ref: SEC-212 and Reviewed-by: Dana Ito, no body."
• Chatter around it. The AI explains the fix and adds tips. Try: Add: "Only the message in 1 code block."

What a strong prompt includes

• Explains the disclosure rule
• Gives the subject prefix
• Gives the trailer lines
• Asks for one code block
• Limits the explanation

Practice this now ↑

Related exercises

• Add dark mode by overriding your existing CSS variables (Coding AI · Software developers)
• Add input checks to your number guessing game (Coding AI · High school students)
• Add labels to a signup form without rewriting the page (Coding AI · High school students)
• Announce the employee assistance program in three steps (Writing AI · HR and recruiting)
• Answer a cyber insurance form honestly from your notes (Cybersecurity AI · Small business owners)