security-triage

To triage GitHub security advisories, follow a structured workflow enforcing trust-model checks, state assessment, and required reads like SECURITY.md to produce high-confidence maintainer decisions with traceable evidence.

Reviewing GHSA reports during vulnerability disclosure intake involves enforcing required reads, performing code review checks, and assessing the advisory state. This formal review flow produces concise, publish-ready resolutions for maintainers.

Yes, this triage workflow applies across vulnerability disclosures, security advisories, and intake reviews for both shipped and open advisories. It guides maintainers through necessary checks to draft maintainer-ready comments and documentation.

Draft maintainer-ready comments and documentation by completing the formal review flow, which includes required reads and trust-model checks. The process ensures decisions are documented with traceable links to inputs and verification checks.

Trust-model checks during security advisory triage verify the reporter's credibility and advisory state before decision-making. Enforcing these checks alongside required reads like the GHSA body ensures high-confidence resolutions with traceable evidence.