Proposed New Idea/Feature (required)
Open source projects are flooded with reports for potential security findings identified by AI. This idea proposes the creation and maintenance of a community deduplication/triage system that would reduce the workload for open source projects and would benefit from common efforts.
Additional Notes (Optional)
Reporters would report findings with a specific format (TBD) and based on the description the system would track the finding and would identify it has been reported before and the status (e.g. discarded as false positive, converted to one or more CVEs, etc.)
The triage would be done based on previous triages and the result and also on a threat model of the product that identifies what is and what is not a threat on the product based on design decisions.
Proposed New Idea/Feature (required)
Open source projects are flooded with reports for potential security findings identified by AI. This idea proposes the creation and maintenance of a community deduplication/triage system that would reduce the workload for open source projects and would benefit from common efforts.
Additional Notes (Optional)
Reporters would report findings with a specific format (TBD) and based on the description the system would track the finding and would identify it has been reported before and the status (e.g. discarded as false positive, converted to one or more CVEs, etc.)
The triage would be done based on previous triages and the result and also on a threat model of the product that identifies what is and what is not a threat on the product based on design decisions.