Cycle380 - Diffing a fresh advisory's OWN just-patched code is low-yield; the yield is in UNPATCHED siblings/copycats

Date: 2026-07-15. Class: methodology / target-selection. Trigger: 5 consecutive fresh-advisory-diff WALKs.

The observation (banked from a 5-walk streak)

This session's fresh-advisory incomplete-fix diffs ALL walked on mature maintainers: onnx (gold-standard), pydantic-ai (gold-standard), Flowise (saturated + mostly-sound), LibreChat (range-set, better than Flowise), mcp-atlassian (proper post-advisory pinning adapter). 0 findings. By contrast, the 2 HITs this session (oras-java, oras-py) came from a SIBLING SWEEP of a CONFIRMED bug's family, targeting LESS-scrutinized code.

The principle

When a CVE/GHSA is fresh, the JUST-PATCHED code is the WORST place to hunt an incomplete-fix: it just received concentrated expert security attention, so the maintainer usually got the 2nd-order cases right (pinning, redirects, transition forms, canonicalization). Diffing their own fix = fighting them on their strongest ground = mostly walks. The YIELD is in code that DIDN'T get that attention: - Cross-language siblings of a multi-impl family (oras-go fixed -> oras-java/py lagged = 2 HITs). - Forks/copycats that vendored or reimplemented the vulnerable shape (Gitea->Forgejo port-lag). - Other projects with the SAME sink that were never notified (needs code-search to find the sink fingerprint, e.g. is_within_directory+extractall, getParent().resolve(link), string-blocklist SSRF).

Actionable refinement

1. Take a fresh advisory -> extract the SINK FINGERPRINT (function shape / guard idiom), NOT just the vuln.
2. Hunt the fingerprint in UNPATCHED siblings/forks/copycats, not the advisory's own repo.
3. The advisory's own repo is worth ONE quick Gate-0 (already-disclosed? residual documented IN the advisory? -> walk) + a fast completeness glance; if the maintainer is security-mature, stop fast.
4. Efficient sibling/copycat discovery needs GitHub code-search (authed gh) -> without it, prefer KNOWN multi-impl families (SDK sets, fork trees) where the siblings are enumerable by hand.

Consequence for THIS box

Box gh is unauth -> the high-yield "sweep unpatched copycats by sink fingerprint" is throttled. So: (a) enumerable multi-impl families (done: ORAS) are the reachable high-yield lane; (b) otherwise the fresh-diff lane is walked-out for now -> prefer operator-side value (file the pile) or gh-auth.

Cross-refs

HITs from sibling sweep: [[2026-07-15-cycle372-lexical-parent-symlink-chain-bypass]] (oras-java), oras-py cycle373. Reference remediations banked from the walks (still valuable): [[pydantic-ai-safe-download-complete-ssrf-fetcher]], onnx, qbee, oras-go.