static-analysis-reviewer

To triage SARIF or CodeQL findings, confirm scanner hits against actual source code, deduplicate by root cause, and categorize results into confirmed defects, false positives, duplicates, and accepted risk with written suppression rationales.

The best way to prioritize SAST vulnerabilities is using a five-axis severity ranking that evaluates reachability, exploitability, asset sensitivity, tenant impact, and business impact to produce an evidence-based remediation list.

Validating exploit paths for high severity static analysis findings requires code-grounded confirmation of the scanner hit against the actual source code to verify reachability and exploitability before prioritizing the defect for remediation.

Yes, you can use this triage process with Semgrep and linter-security output, as it applies to SAST, CodeQL, SARIF, Semgrep, and linter-security formats when a security gate needs evidence-based prioritization and deduplication.

You need a written rationale for suppressing static analysis false positives to maintain a defensible audit trail, ensuring every false positive or accepted-risk decision is governed by evidence-based suppression documentation.

You need static analysis triage for a failing security gate when CodeQL or SARIF scans produce noisy results and you require a concise, prioritized remediation list with evidence-based dispositions separating true defects from accepted risk.