fp-check

To verify if a reported security vulnerability is a true positive or false positive, trace the full validation chain and attacker control to the sink, then assess mathematical feasibility and exploitability to produce an evidence-based verdict.

The best way to perform vulnerability triage on suspected security bugs is applying a linear checklist for straightforward claims or escalating to task-based orchestration for complex scenarios to systematically eliminate false alarms.

Data flow tracing helps in false positive analysis by mapping the validation chain and attacker control from source to sink, ensuring pattern-matching rationalizations are rejected in favor of documented, evidence-based verification.

You should use deep verification instead of a standard checklist for threat modeling when analyzing ambiguous or cross-component vulnerability scenarios that require task-based orchestration to thoroughly assess exploitability.

Vulnerability scanners report false positives due to pattern-matching without full validation-chain analysis; you can triage them by restating the claim context, tracing attacker control to the sink, and completing a six-gate verdict with devil's-advocate review.

Yes, you can assess exploitability for cross-component security bugs without false alarms by applying a dedicated false-positive checklist and rejecting common rationalizations during the final six-gate verdict process.