// GLOSSARY

Fix-first backlog

An ordered, owned, actionable remediation work list by business impact and risk level. It is the primary evidence object of the Application Security Penetration Test. Not a to-do list; a prioritized work decision derived from proven technical reality, ready to enter the product team’s sprint queue directly. Turkish equivalent: prioritized remediation work list.