triaging-findings

Security scanner triage validates each finding for authenticity and actionability, deduplicates results across multiple tools, and re-ranks survivors by derived exploitability. It processes raw scanner outputs, markdown, or JSON reports to produce concise actionable triage views.

Vulnerability deduplication collapses duplicate findings from multiple scanners into a single canonical finding. This triage process normalizes raw outputs and markdown or JSON reports, ensuring each unique vulnerability appears only once for downstream remediation.

Ranking by exploitability prioritizes verified findings using derived exploitability metrics rather than relying on default scanner severity. This approach re-ranks survivors after deduplication to ensure remediation efforts target genuinely exploitable vulnerabilities first.

Vulnerability triage accepts VULN-FINDINGS.json, raw scanner results, and markdown or JSON reports as input. It normalizes these formats during interactive ingestion, supporting checkpointed processing to ensure reproducible triage sessions before outputting TRIAGE.json and TRIAGE.md.

Routing assigns each verified and deduplicated finding to an appropriate owner for remediation and follow-up. The triage process tags every surviving vulnerability after exploitability ranking, coordinating remediation across security and development teams through structured output files.

Security findings triage generates TRIAGE.json and TRIAGE.md outputs for downstream remediation workflows. These files contain verified, deduplicated, and exploitability-ranked findings routed to owners, enabling coordination across security and engineering backlogs.