vulnerability-validation

To validate security findings for exploitability, you need a threat-model.md and a security-findings.json file. The process evaluates each finding's reachability and impact, outputting a validated-findings.json with statuses and CVSS scores.

The best way to reduce false positives is to perform a threat-model-guided review of high and critical findings. This assesses actual exploitability paths within the codebase, filtering noise and producing audit-ready validated results.

Yes, a threat model is required. You must place a threat-model.md file at .factory/threat-model.md to guide the exploitability assessment and generate accurate mitigation and proof-of-concept guidance.

Yes, you can filter security findings by severity or specific finding IDs. The validation process accepts optional inputs for finding IDs and severity filters to focus the exploitability analysis on targeted subsets.

Proof-of-concept guidance provides actionable steps and evidence-backed remediation paths for confirmed exploitable vulnerabilities. It references PoC steps directly within the validated-findings.json output for audit readiness.

The validated security findings output uses the validated-findings.json format. It contains validation statuses, exploitability paths, and CVSS scores to provide audit-ready documentation for confirmed issues.