Security Scanner Triage
Workflow
- Normalize findings
- Convert scanner text into discrete claims.
- Group by category: data routing, credentials, defaults, docs mismatch, privilege/persistence.
- Verify against code/docs
- Locate exact file/line evidence.
- Mark each claim as:
- Confirmed
- Partially confirmed
- Not reproducible
- Risk rate
- Critical / High / Medium / Low
- Include blast radius and exploitability notes.
- Remediation plan
- Provide minimal patch order:
1) safety first
2) behavior/docs consistency
3) version bump and publish notes
- Verification
- Provide re-scan checklist and expected clean-state signals.
Output format
Use references/output-template.md.
Guardrails
- Never leak secrets from
.env. - Distinguish trust/disclosure issues from active vulnerabilities.
- Always separate "data-routing transparency" findings from "security-impact" findings.