Fix it in your stack. Each card fixes one weakness in one stack: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests that tell them apart. Every card is a project you can download and run, and every one was run in all three modes before it was published.
Each card runs its tests against the vulnerable code, the fix and the wrong fix, and names the exact versions it ran with. Theversion policy lists the framework and runtime versions the cards support, and the scanner rules page lists every Semgrep, CodeQL and other rule ID they record. A stack without a card for a weakness says why: safe by default (its default behaviour prevents the weakness, with the source on the weakness page), planned, or the nearest card.
Practice with them: the Find it, then fix it drills ask you to pick the vulnerable lines, the real fix and the test that catches the wrong fix.
Each card holds three implementations of the same code: vulnerable, fixed, and a plausible fix that still fails. One test suite runs against all three. The fixed implementation must pass every test, the vulnerable one must fail at least one exploit test, and the wrong one must fail at least one test. The scanner rules on each card were run against its code where possible, and the card records what each one found.