// GLOSSARY

Fix-first Backlog

An ordered, owned, actionable remediation work list by business impact and risk level; the primary evidence object of the Application Security Penetration Test. Most security reports deliver a heap of findings and leave prioritization to the reader; yet a hundred-finding list is a burden for the product team if it does not say which work comes first, and a decision if it does. The fix-first backlog draws this line: it derives each finding from proven technical reality, ties it to an owner, and phrases it so it can enter the sprint queue directly. Its difference lies in the ordering; which vulnerability is closed first is set not by the finding's raw severity but by weighing together the harm it would do to the business if left open and the cost of the fix. Mapped to frameworks such as OWASP ASVS, the list answers not only 'what to do' but also 'which requirement it satisfies'. Its Turkish equivalent is the prioritized remediation work list.