Between a CVE and its patch, engineering owns the fix and security owns the risk. We found a point in that gap security can control: the step every exploit must take and legitimate code never does.