security-triage

Triage GitHub security advisories by applying a deterministic review workflow that reads SECURITY.md, queries GHSA bodies, inspects implicated code paths, and verifies shipped state using git tags and npm version checks to produce high-confidence close or keep decisions.

Verifying the shipped state during a GHSA triage involves checking git tags and running npm version checks to confirm whether the implicated code path actually exists in the released package, guiding the final triage decision.

A security advisory trust model helps narrow vulnerability reports by enforcing a framework for decision making that reviews exploit paths, inspects code, and evaluates risk considerations to determine if a report should be narrowed or closed.

A maintainer workflow enforces deterministic checks for security advisories by systematically reading SECURITY.md, querying GHSA bodies via API, inspecting implicated code paths, and confirming shipped state to generate maintainer-ready triage replies.

Inspect implicated code paths for a GitHub security advisory when a new report arrives and you need precise verification to determine whether to close, keep open, or narrow the advisory with detailed justification.

Automated GHSA triage relies on deterministic checks like reading SECURITY.md and verifying shipped state via git and npm, meaning it may not fully capture nuanced exploit contexts without manual review of the implicated code paths.