sap-security-patchlisted

# SAP Security Patch Day SAP publishes Security Notes on the **second Tuesday of each month (~09:00 CET)**. This skill turns "the month's notes" into "the prioritized subset that applies to *your* system and isn't applied yet." [P1] > **Guardrail — patching is change management, not a shell command.** > - **Never apply notes directly to PRD.** Path is **DEV → QAS → PRD** via the transport route. > - **HotNews first:** CVSS **9.0–10.0** notes within your emergency-patch SLA; then High (7.0–8.9). [P2] > - Take a **backup/snapshot** and check each note's **prerequisites, manual pre/post steps, and side > effects** before implementing (SNOTE shows dependencies). > - This skill **produces the analysis and plan**; it does not auto-apply. Implementation is a human, > change-controlled action. --- ## 1. Cadence & priority model - **When:** 2nd Tuesday monthly. Track it as a recurring task. [P1] - **Priority (CVSS v3):** **HotNews** 9.0–10.0 · **High** 7.0–8.9 · **Medium** 4.0–6.9 · **Low** <4.0. HotNews = "very high" priority, patch fastest. [P2] - **Note types:** ABAP **correction** notes (→ SNOTE), **kernel/SP** notes (→ SUM/SPAM, not SNOTE), **manual/config** notes (parameter or config change). Know which before planning (§5). --- ## 2. Retrieve the month's Security Notes (browse) The authoritative source is the **SAP Support Portal → "SAP Security Notes"** (ONE Support Launchpad / SAP for Me). It is **behind S-user authentication**, so retrieval needs an authentic