fix == vector: shipping a security fix to a whole fleet without arming the attacker

Description and use

A public commit exposes vulnerability details, creating a race between publishing a fix and patching all nodes. Pulsed Media follows a sequential process: neutral commit → central idempotent push → convergence verification → disclosure after full patching, reducing the exposure window to hours.

Problem

Public source commits expose vulnerability details, creating a race between publishing a fix and patching all running nodes.

Outcome

The vulnerability was closed across the fleet within hours, and the advisory was published only after all nodes were patched, minimizing the exposure window.

Workflow

• 1. Commit the fix to the public repository with neutral wording that describes a refactor, not an exploit.
• 2. Immediately trigger a central, idempotent fan‑out mechanism to push the update to every node.
• 3. Verify that each node has applied the new code and that the service recovers, comparing against a pre‑deploy baseline.
• 4. Release the advisory, CVE details, and writeup only after the fleet has converged.

Evidence

The moment the fix lands in public source, the clock starts. Until every running copy has the fix, the diff is a map to an unpatched machine.

Source

Converge the fleet fast, then verify it. "We pushed the fix" is not "the fleet is fixed."

Source

Disclose only after convergence.

Source