security-disclosure-triage

Triage a security advisory by reproducing the advisory construct against a target repository checkout to verify it maps to a real vulnerability, checking trust boundaries, and assigning an honest severity based on version grounding.

Assess the severity of a GHSA draft report by enforcing a stepwise evaluation from reproduction to trust boundary checks and version grounding, which produces structured triage artifacts with a recommended disposition and honest severity calculation.

Reduce false positive vulnerability confirmations by identifying the crown-jewel asset and the actual guard in the target repository, ensuring the scanner finding maps to a real disclosable vulnerability before confirmation.

Yes, you can use this triage process for draft reports from external researchers. It evaluates incoming advisories from the reporter side to decide if the vulnerability is worth disclosing, optimizing against false confirmations and inflated severity.

You need structured triage artifacts for vulnerability disclosure when you must document the recommended disposition and severity calculation for a security advisory, ensuring an honest evaluation across codebases requiring responsible disclosure.