security-triage

Security triage of GitHub advisories involves analyzing the trust model, verifying shipped releases, and inspecting exact code paths to determine if a report should be closed, kept open, or narrowed. This produces maintainer-ready responses with precise closure reasons and code references.

Trust-model analysis checks whether reported vulnerability behavior falls outside the documented security boundary or only affects trusted local, host, or operator state. This determines if an advisory is in scope or can be closed as out of bounds.

Shipped-state verification confirms whether a vulnerability exists in released tags or npm versions and whether a fix landed before the affected release. This prevents closing advisories for issues still present in production code.

Yes, triaging draft advisories produces firm, specific replies with exact code references, release facts, and optional hardening notes. Responses cover closure, keep-open, or keep-open-but-narrow decisions for duplicate, invalid, or out-of-scope reports.

Narrowing an advisory applies when part of the report is valid but the scope is broader than the actual vulnerability. Exact code-path inspection identifies the real affected paths, allowing a keep-open-but-narrow response with precise code references and release facts.

Security triage requires accurate shipped-release data and clear trust-model boundaries to make confident decisions. Cases with ambiguous security boundaries, unreleased code, or incomplete advisory details may still need manual maintainer judgment beyond the triage output.