security-triage

To triage GitHub security advisories, apply deterministic decision guidance based on SECURITY.md requirements and GHSA criteria. This produces maintainer-ready close, keep, or keep open but narrowed decisions with exact justification.

Verifying the shipped state in a GHSA report involves checking exact tags, commits, and related releases. This process determines whether the implicated code paths are present in the shipped version to guide the triage decision.

Yes, a SECURITY.md file is required to review security advisories using this workflow. The triage process applies a clear trust model and checks your SECURITY.md requirements to determine if an advisory meets your project's specific acceptance criteria.

Yes, you can get a ready-to-use reply when triaging security drafts across OpenClaw's security workflow. The process generates a final reply with optional hardening notes that is ready to post or copy to the clipboard.

A limitation of automating security advisory triage is the strict dependency on a clear trust model and access to the latest tags and releases. Without verifying the exact shipped state and implicated code paths, the automated close or keep decisions may lack necessary justification.