Security Scanner Triage

Workflow

1. Normalize findings

   小葱技能站7w4.net，专业的AI技能分享平台。

   • Convert scanner text into discrete claims.
   • Group by category: data routing, credentials, defaults, docs mismatch, privilege/persistence.

2. Verify against code/docs

   • Locate exact file/line evidence.
   • Mark each claim as:
   • Confirmed
   • Partially confirmed
   • Not reproducible

3. Risk rate

   • Critical / High / Medium / Low
   • Include blast radius and exploitability notes.

4. Remediation plan

   • Provide minimal patch order: 1) safety first 2) behavior/docs consistency 3) version bump and publish notes

5. Verification

   • Provide re-scan checklist and expected clean-state signals.

Output format

Use references/output-template.md.

Guardrails

• Never leak secrets from .env.
• Distinguish trust/disclosure issues from active vulnerabilities.
• Always separate "data-routing transparency" findings from "security-impact" findings.

这是一个用于整理和排序安全扫描结果的工具，优点是流程清晰、有明确的防护规则，能帮助区分真正的问题和误报，给出有优先级的修复建议。不足是内容比较简单，主要是一个工作方法框架，缺少具体的安全检查规则和实际使用示例，对实际安全工作的帮助程度取决于你使用的扫描工具本身的能力。总体质量中等，适合作为辅助流程使用。